PowerShell is starting unexpectedly on my home Windows PC and using a large amount of upload bandwidth. Ending the process in Task Manager only stops it temporarily, and it later launches again. What should I check to identify the script or task responsible, and what is the safest way to handle it if this is malware?
4 Answers
A recurring PowerShell process is often started by a Scheduled Task, startup entry, service, or another persistence mechanism. Disconnect the computer from the network first, then inspect Task Scheduler and startup locations. Avoid uploading suspicious scripts or decoded commands to random websites.
Open Task Manager, switch to the Details tab, and add the Command line column. This can show the script, encoded command, or arguments that launched powershell.exe. Event Viewer may also contain useful entries under the Windows PowerShell logs.
After cleaning the system, change passwords from another trusted device, sign out of active sessions, and enable two-factor authentication on important accounts. Also update Windows and applications before restoring files, and reinstall software only from official sources.
Because the process is unexpectedly sending a lot of data from a personal computer, treat it as a possible compromise rather than assuming it is normal Windows activity. Save only personal documents you trust, scan them separately, and reinstall Windows from installation media created on a known-clean computer. A basic in-place reset may not remove every persistence mechanism.
I wiped the Windows drive and installed a fresh copy instead of using the built-in reset option. The unexpected PowerShell activity has stopped so far, and I’m changing account passwords as a precaution.