After a recent Windows update, two PowerShell processes started appearing in the background. One stays running while another launches and exits about once per second. Windows Defender found nothing, and Malwarebytes only reported heuristic detections related to a programming language and its package manager, which appear to be false positives.
Event Viewer shows repeated PowerShell events, including Provider Lifecycle (600), Engine Lifecycle (400), and Pipeline Execution Details (800). The command being executed is a noninteractive, profile-free PowerShell script that uses C# interop to call SHQueryUserNotificationState from shell32.dll and check the current notification state. Process Monitor shows it accessing many Microsoft components as well as files associated with installed applications.
I also noticed that csc.exe, the .NET C# compiler, repeatedly runs with temporary command-line files under my user profile's Temp folder. Is this normal Windows behavior, or could it indicate malware?
2 Answers
The temporary .cmdline file is probably being generated for the C# compiler because the PowerShell command calls Add-Type. PowerShell compiles the embedded C# code through csc.exe, which explains the compiler activity and the constantly changing temporary file. That behavior alone is not proof of malicious activity, but checking the parent process is still the best way to confirm what initiated it.
The script is checking whether Windows is currently in a state where it can display user notifications. That explains why it touches various installed applications—it is likely checking whether one of them is interrupting the user, rather than scanning those programs.
The important next step is to identify the parent process instead of focusing only on PowerShell. You can run:
Get-CimInstance Win32_Process | Where-Object Name -eq 'powershell.exe' | Select-Object ProcessId, ParentProcessId, CommandLine
Then inspect the parent process with:
Get-Process -Id
If the parent is a familiar application, it may simply be poorly designed software repeatedly launching PowerShell. If it is an unknown executable running from locations such as %TEMP% or %APPDATA%, investigate further.
That identified the cause. The parent process was Edge-Drop, a clipboard-history application I had recently installed to replace Ditto. It was repeatedly launching the notification-state check, so this turned out to be a badly behaved application rather than malware.
The file was replaced too quickly to inspect, but identifying the parent application solved the problem. It was the same Edge-Drop process, and removing or disabling that application stopped the repeated PowerShell and csc.exe launches.