powershell.exe is blocked by Trend MicroScan

Question

Windows 11.

I used the Microsoft Safety Scan today and it found no problems.

My virus protection software, Trend Microscan, wants to block powershell.exe.

When I first turn on my computer, the software repeatedly asks to block efforts by powershell.exe to delete files.

I have read that powershell.exe is a required part of the Microsoft Windows system.

I don't understand the problem that my virus protection software is finding.

Has anyone else encountered this problem?

Thanks,

Leslie

Answer 1

Powershell itself as an app is legitimate, but looks like something might be trying to run via Powershell upon startup and that may not be legitimate. Powershell doesn't need to be a startup item for Windows.

To check further, can you please do this -

Hold down Ctrl + Alt + Del, launch Task Manager, then go to Startup tab. Sort status so the enabled ones are on the top. Then take a screenshot for me so I can see what's all listed as "enabled" items.

Then, hold down Win+R keys, type in

shell:startup

Press enter. It should launch a folder,. Share a screenshot of the items in this folder if any.

I will review and let you know if I am seeing anything that might be related to that.

Answer 2

powershell.exe is a legitimate Windows component, but security software can still block it when something is trying to use PowerShell in a suspicious way. In Microsoft 365 app installation scenarios, this exact kind of issue can happen when PowerShell is blocked by security software.

For a Windows 11 home PC, the safest interpretation is:

1. Do not allow it automatically just because powershell.exe is a Windows file. Malware often uses legitimate tools such as PowerShell to run commands, download content, or delete files.
2. Avoid running two real-time antivirus products at the same time. Running Microsoft Defender together with another real-time security product can affect performance and can also cause update or install problems. If Trend Micro is the chosen real-time antivirus, keep only one real-time product active.
3. Since Microsoft Safety Scanner found nothing, run Microsoft Defender scans from Windows Security as a second check:
   • Open Start > Settings > Update & Security > Windows Security > Virus & threat protection.
   • Make sure security intelligence is up to date.
   • Run a Full scan.
   • If the prompts continue at startup, run Microsoft Defender Offline scan.
4. Check for software that may be triggering PowerShell at startup. Repeated prompts right after sign-in usually indicate a startup item, scheduled task, or installed software trying to launch PowerShell. If there are recently installed apps or browser-related utilities that were not intentionally installed, uninstall them from Settings > Apps > Apps & features.
5. If Trend Micro keeps reporting PowerShell trying to delete files, treat that activity as suspicious until proven otherwise. In Windows Security, if a threat is detected, use Remove or Quarantine unless the file and publisher are fully trusted. Allow a file only if it is known and trusted.
6. If the behavior continues after scans and uninstalling unwanted software, submit the suspicious files to Microsoft and run Microsoft Defender Offline again.

A repeated startup prompt is not normal behavior for PowerShell by itself. The likely issue is not that powershell.exe exists, but that another program is attempting to use it in a way the antivirus considers risky.

---

• "Windows cannot access the specified device, path, or file" error when installing Microsoft 365 apps
• Antivirus and antimalware software: FAQ
• Protect your PC from unwanted software
• Endpoint Protection client frequently asked questions
• Virus and threat protection in Windows 11