Is it common that Powershell.sys file be flagged as malware by the antivirus?

Question

Is it common that Powershell.sys file be flagged as malware by the antivirus?

Silverio Morales 20

I am writing to seek clarification regarding an issue we have encountered with our antivirus software (Bitdefender). Recently, PowerShell version 7.5.1.0 has been auto updated in some of our workstations and the PowerShell.sys file on our system was flagged as malware by our antivirus application. Given the critical nature of this file, I wanted to inquire if it is common for this file to be flagged as a potential threat.

Could you please provide any insights or guidance on this matter? Specifically, we are interested in understanding whether this is a known issue and if there are any recommended steps we should take to address it.

Thank you for your assistance.

Accepted answer

0 additional answers

Your answer

Answer 1

Michael Taylor 60,161

Powershell.sys? That would seem to indicate a kernel driver that has something to do with Powershell. AFAIK there is no such file or feature in Powershell. Powershell is .NET based so running it in kernel doesn't even make sense anyway.

The only online references to such a file I can find is related to installing Marvel Rivals. It appears that the game uses Powershell and it uses a kernel driver, this file, to do something. That isn't an MS product.

I did a quick grep on 2 different systems with the latest PS installed and they don't have that file either. I install PS using WinGet but I don't know that it matters how you installed it.

Can you confirm that this file was actually installed by Powershell? Can you confirm it is digitally signed by Microsoft? Can you look at the path to the file and confirm it is in a path of an MS product (most of the time it is in C:\windows\system32\drivers)?

My gut instinct is that your AV may be right. Either that or somebody is installing a game on their PC.

Silverio Morales 20 Reputation points

2025-05-29T16:08:41.95+00:00

This path C:\Windows\System32\WindowsPowerShell\v1.0 is where the PowerShell.sys was supposed to be stored but, since the antivirus blocked and deleted the file, there is no way for us to find the file in place.

Please see picture reference of the Bitdefender below:
Michael Taylor 60,161 Reputation points

2025-05-29T16:21:47.4633333+00:00

The path you gave isn't PS Core 7.x. PS Core installs to C:\Program Files. The path you gave is for the older Windows Powershell 5 that ships with the OS. So PS 7.x won't touch that directory structure at all.

Irrelevant even Windows Powershell 5 didn't have, AFAIK, a powershell.sys file. PS doesn't run in kernel mode and doesn't need a driver.

I stand by either AV is right or a game is installed that put it there.
Silverio Morales 20 Reputation points

2025-05-30T14:44:01.5466667+00:00

Thank you very much for your responses, Michael, we are further investigating more details with our antivirus representatives to determine if this is a false positive or an actual virus.

Share via

Is it common that Powershell.sys file be flagged as malware by the antivirus?

0 additional answers

Your answer