How do I stop this Pop Up of Windows Powershell?

Question

So I think I accidentally enabled a malware onto my system, this notification keeps popping up repeatedly even after I press no, like instantly one second after pressing no. Any advice?

Answer 1

• Download Fixlist.txt and save it in the Downloads folder.
• Close any apps with unsaved work.
• Run FRST64.exe and click "Fix".
• The computer will reboot to complete the procedure.

Please upload Fixlog.txt so I can check if any further action is needed.

Answer 2

To stop the pop-up notifications from Windows PowerShell, especially if you suspect malware, you can take the following steps:

1. Run a Full System Scan: Use Windows Defender or another trusted antivirus software to perform a full system scan. This will help identify and remove any malware that might be causing the pop-ups.
2. Check Startup Programs: Sometimes, malware can set itself to run at startup. You can check your startup programs by pressing Ctrl + Shift + Esc to open Task Manager, then navigating to the "Startup" tab. Disable any suspicious programs.
3. Use Task Manager to End the Process: If you see a PowerShell process running that you did not start, you can end it in Task Manager. Right-click on the task and select "End task."
4. Uninstall Suspicious Programs: Go to "Control Panel" > "Programs and Features" and look for any recently installed or suspicious programs. Uninstall them if necessary.
5. Reset PowerShell Settings: If you have made changes to PowerShell settings, consider resetting them to default. You can do this by running the command Get-ExecutionPolicy in PowerShell and changing it back to Restricted if it has been changed.
6. Check for Windows Updates: Ensure your Windows is up to date, as updates often include security patches that can help protect against malware.

If the problem persists after these steps, you may want to consider seeking professional help to ensure your system is clean and secure.

---

References:

• Prevent malware infection
• How to remove potentially harmful software

Answer 3

1

Please provide a screenshot of the PowerShell popup notification you are seeing.

2

Click the link below to download a small free utility that does not require installation.

https://download.sysinternals.com/files/Autoruns.zip

When the file downloads, unzip it.

Run Autoruns64 as Administrator

A

Select the 'Logon' tab at the top of Autoruns.

Please provide a screenshot of all entries on that tab.

B

Select the 'Scheduled Tasks' tab at the top of Autoruns.

Please provide a screenshot of all entries on that tab.

Answer 4

So that the infection can be competely removed, please provide Farbar Recovery Scan Tool (FRST) logs for analysis.

https://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/

Note: If you are using Edge or Chrome, SmartScreen may initially block the download. Click on the three dots next to the warning and select Keep => Click the Delete drop arrow => Keep anyway.

• If your computer's language is not English, rename FRST64.exe to FRST64English.exe
• Run the tool, leave the default settings, and press Scan.
• Zip the logs, FRST.txt and Addition.txt, then upload to a cloud storage service like OneDrive, Google Drive or gofile.io
• Post the share link.

Share OneDrive files and folders - Microsoft Support