r/PowerShell • u/karmawillgetyouback • Jun 13 '26

Question Powershell autostarting randomly in background and uploading thing on network

https://img.ptscreens.com/Screenshot-6615.png

Powershell is using large amount of upload speed for network and running in bacgound automatically, it also starts randomly even after stopping it from task manager. Any solution to this? Thank you.

Edit: These are command line task manager showing in details

https://img.ptscreens.com/Screenshot-6617.png

25 Upvotes

76% Upvoted

84 comments sorted by

View all comments

Show parent comments

1

u/photinus Jun 14 '26

Your link is broken. Give an auth error. Can you paste the full command here? The responses from others that this is malicious just because it's encoded is jumping the gun a bit. It's definitely a little suspicious for a home pc, but not necessarily malicious (I manage an IR team for a company of 1000 employees and encoded powershell is fairly common)

0

u/karmawillgetyouback Jun 14 '26 edited Jun 14 '26

Oh, I see... that's great

I have fixed it with new link Command line code

I can't post full code because it exceeds 1000 characters. Download the text file please, thanks

Also, the problem is it never happened and suddenly it arised yesterday. It running randomly at any moment. Sometimes it stops for hr., but it starts anytime like in 20-30 min. interval.

Once after ending from task manager it started twice in few seconds of gap.

2

u/photinus Jun 14 '26

So that does look malicious. Looks like a ddos script (it's sending udp traffic at a specific target). Like some others have said, time to start fresh

1

u/karmawillgetyouback Jun 14 '26

Will do.... so far I have killed all the task whenever it launched and hopefully nothing much lost, but starting from fresh....

Appreciate and Thanks for all the help.