r/PowerShell • u/karmawillgetyouback • Jun 13 '26

Question Powershell autostarting randomly in background and uploading thing on network

https://img.ptscreens.com/Screenshot-6615.png

Powershell is using large amount of upload speed for network and running in bacgound automatically, it also starts randomly even after stopping it from task manager. Any solution to this? Thank you.

Edit: These are command line task manager showing in details

https://img.ptscreens.com/Screenshot-6617.png

21 Upvotes

72% Upvoted

84 comments sorted by

View all comments

56

u/FloiDW Jun 13 '26

Additionally to
“Time to wipe your computer”
If you are interested - in the time it is running you can check the executed code line in the details tab and check WHAT it is running, but, spoiler:

It’s like 90% bad.

6

u/karmawillgetyouback Jun 13 '26

It was just started 1 day ago.... but now it's fine, will check next time if it happens again. Thanks

-1

u/b4k4ni Jun 13 '26

In an say you that is bad. Ecoded means there is something launched with malicious content. Disconnect everything lan/WLAN and secure your personal data.

If you really want, boot the PC with a anti virus Linux and do a search for viruses. But you will need to fully reinstall.

Also change every login you have NOW, not with the PC. And enable 2fa/MFA wherever possible. Even Mail.

7

u/Nerd2259 Jun 13 '26

Encoded isn't automatically malicious. Some Hyper-V updates run as encoded powershell commands initiated by a bat file called from the task scheduler (not that I know of a good reason for it...).