Whenever I turn on my Windows PC, a PowerShell or Terminal window opens by itself and only shows a prompt like `PS C:Users(my username)>`. I ran full and offline scans with Malwarebytes and Windows Defender, but neither found anything. Could this be malware, or is there a normal startup setting causing it? Disabling Terminal in the Startup Apps section of Task Manager stopped the window from appearing.
4 Answers
A PowerShell window opening at login doesn’t automatically mean an infection. Startup settings, scheduled tasks, Windows Terminal preferences, or a PowerShell profile can all cause it. Since turning off Terminal in Task Manager fixed the issue, that startup entry is the most likely explanation, though checking the logs or profile can provide extra confirmation.
If it isn’t listed clearly in Startup Apps, check Task Scheduler and use Microsoft Sysinternals Autoruns. Those tools can show programs, scheduled tasks, services, and other entries that launch when you log in.
If you want to find out exactly what PowerShell is running, enable a transcript in your PowerShell profile. You can check whether the profile exists with `Test-Path $PROFILE`, create it with `New-Item -Path $PROFILE -Type File -Force`, and add `Start-Transcript` to the file. The next time PowerShell opens, its commands will be recorded in your Documents folder for inspection.
Check the Startup Apps section in Task Manager first. Windows Terminal can be configured to launch when you sign in, so disabling its startup entry may solve it without there being any malware involved.
You can also create the profile and add the transcript command in one step with `New-Item -Path $PROFILE -Type File -Force -Value 'Start-Transcript'`.