Whenever I turn on my PC, a PowerShell window opens and only shows a prompt like `PS C:Users(my username)>`. Malwarebytes, Windows Defender, and an offline scan found nothing. Could this still be malware, or is a Windows startup setting launching it? Disabling Terminal in Task Manager's Startup apps fixed the issue, but I'd like to understand what caused it and whether I should check anything else.
4 Answers
To find out what PowerShell is actually running, you can enable a transcript in your PowerShell profile. Run `Test-Path $PROFILE`; if it returns false, create the profile with `New-Item -Path $PROFILE -Type File -Force`. Then open it with `notepad $PROFILE` and add `Start-Transcript`. The next time PowerShell starts, its commands will be recorded in your Documents folder.
If nothing obvious appears in Startup apps, check Task Scheduler for tasks configured to run at user logon. Sysinternals Autoruns is also useful because it lists startup entries from more locations than Task Manager.
Check Task Manager > Startup apps first. Windows Terminal has an option to launch when you sign in, and disabling that entry can stop the PowerShell window from appearing. Since turning off Terminal fixed it, this is probably a startup setting rather than malware.
A blank PowerShell prompt by itself usually just means a terminal was launched without a command. Your clean security scans and the fact that disabling the Terminal startup entry solved it both point toward a configuration issue. Still, reviewing scheduled tasks and startup entries is a good precaution.
Logging is useful if the window comes back, because it can show whether a script or scheduled task launched PowerShell. Once you know the command, it is much easier to determine whether it is legitimate.