My Windows PC recently started opening PowerShell during startup and displaying an error about a script trying to copy itself over the same file. The script is located under my user profile and was configured to run automatically. Windows Defender did not initially detect anything, so I wanted to know whether this behavior was normal. After inspecting the script, it appeared to create registry startup entries, run hidden with execution-policy bypass, contact a remote command-and-control server, and execute commands received from it. A malware scan later found numerous threats. After reinstalling Windows, the issue returned when I restored a heavily modded game folder, suggesting that one or more downloaded mods may have been compromised.
4 Answers
A clean reinstall is the safest option here, but make sure the installation media is created on a trusted computer and that you delete the existing system partitions during setup. Also review browser sessions, saved passwords, game accounts, and any other accounts used on the infected machine.
That script is absolutely malicious. It establishes persistence through the registry, runs PowerShell hidden, connects to a remote server, and can execute commands on your computer. Treat the machine as compromised: disconnect it from the internet, back up only personal documents you can verify, scan from trusted boot media if possible, then perform a clean Windows installation. Change important passwords from a different, clean device and enable two-factor authentication.
First inspect the script contents rather than assuming the startup error is harmless. The commands shown are a reverse shell, which lets someone remotely issue PowerShell commands and receive the results. Antivirus software can miss this kind of custom script, especially if it was recently created or downloaded.
If the problem comes back after reinstalling, do not restore the old game or mod folder wholesale. Reinstall the game from a trusted source and add mods gradually, checking their files and download sources. A compromised mod or bundled installer could recreate the startup entry after Windows has been cleaned.
That makes sense. The infection returned immediately after I restored my large mod collection, so I removed the folder and will avoid those mods until I can identify the bad download.