Powershell suspiciously high ram usage

Question

Lately, Powershell pops up for less than a second, and I see it hogging 2 GB of ram in the task manager. It's obviously malware, but I can't seem to remove it.

In a similar post **** here. the moderator adviced the user to download a recovery tool from the following link:

https://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/

Then, the user had to scan the PC with it, upload 2 logs and proceed with the removal. Anyone here who can help me fix this thing? Obviously virous scanning with WIndows Defender and BitDefender didn't work...

Answer 1

Hi J.Panda,

I am Dave, I will help you with this.

Click the link below to download a small free utility that does not require installation.

https://download.sysinternals.com/files/Autorun...

When the file downloads, unzip it.

Run Autoruns64 as Administrator

1

In the filter box in Autoruns, type powershell and press Enter.

If that finds any entries, please provide a screenshot of that.

2

In the filter box in Autoruns, type ps1 and press Enter.

If that finds any entries, please provide a screenshot of that.

3

In the filter box in Autoruns, type rundll and press Enter.

If that finds any entries, please provide a screenshot of that.

Answer 2

Hi J.Panda,

Sorry, I was offline, rest assured, you can safely delete that PowerShell entry, that will ensue it does not come back, or if you prefer, you can leave that entry unticked, that will just leave the redundant entry in the registry.

Answer 3

Hi J.Panda,

Those popups are usually remnants left in the registry of malware that has already been removed form your PC by Defender or your preferred 3rd party anti-virus, it is unlikely to come back if you have now removed that entry in Autoruns, also, you can now delete the Autoruns folder.

Answer 4

Here's the screenshot for Step 1:

Besides this, it couldn't find neitehr of Step 2 nor 3's things.

Answer 5

Hi J.Panda,

Thank you for the screenshot, untick that entry, then restart your PC and wait to see if the PowerShell popup has stopped, if it has, open Autoruns again and right click that entry in Autoruns and delete it.