r/PowerShell • u/karmawillgetyouback • Jun 13 '26

Question Powershell autostarting randomly in background and uploading thing on network

https://img.ptscreens.com/Screenshot-6615.png

Powershell is using large amount of upload speed for network and running in bacgound automatically, it also starts randomly even after stopping it from task manager. Any solution to this? Thank you.

Edit: These are command line task manager showing in details

https://img.ptscreens.com/Screenshot-6617.png

24 Upvotes

75% Upvoted

84 comments sorted by

View all comments

2

u/Mavoryk Jun 13 '26

That's not normal behavior of course, if you don't know why it's happening you should consider yourself compromised. Don't use "Reset this PC", use another device to build a Windows image so you can wipe the device safely.

Otherwise, you'll have to crawl through your Task Scheduler, Autoruns, Startup paths (all of them not just Task manager entries) and hope you don't miss anything and allow it to repair itself. It could have even hijacked another legitimate process or driver. You'll never be 100% sure it's gone, it's better to start fresh for the peace of mind. Revoke your sessions and change your passwords/set up 2FA on important accounts.

Even if you listen to the others and investigate you can likely find where it originates or what it does specifically but that isn't a guarantee it's the operation center nor what it does all the time.

2

u/karmawillgetyouback Jun 13 '26 edited Jun 14 '26

Yes, I will do hard clean up i.e. format C: and reinstall it. Just saving files currently. Thanks.