Script virus?

[Vibes NoVibes]

Every couple of hours I see a powershell script pop up and vanish which makes me think I may have some virus/malware on my system. I have premium versions of Norton and BitDefender but both aren't able to take care of the issue. Also downloaded trial versions for Avast and Kas but no relief.

 

What else could I try out here?

[BetteBalterZen]

Do you see any logs in Event Viewer on the timestamp of the PS script?

[Vibes NoVibes]

12 minutes ago, BetteBalterZen said:

Do you see any logs in Event Viewer on the timestamp of the PS script?

Thanks mate for a quick response!

 

I see this in EV. Doesn't look like suspicious activity but I did recently run into a couple of malwares and so I am wondering if anything was left behind. Would you recommend clearing the log so that I can see things clearly here the next time it pops up? It disappears within nanoseconds.

 

 

[BetteBalterZen]

18 minutes ago, Vibes NoVibes said:

Thanks mate for a quick response!

 

I see this in EV. Doesn't look like suspicious activity but I did recently run into a couple of malwares and so I am wondering if anything was left behind. Would you recommend clearing the log so that I can see things clearly here the next time it pops up? It disappears within nanoseconds.

 

 

I understand. Well, I don't think clearing the log is actually necessary because when the scripts runs again, you can just see the time and then check the EV again. But maybe someone else here have a better way to do it/this. 

[Vibes NoVibes]

8 minutes ago, BetteBalterZen said:

I understand. Well, I don't think clearing the log is actually necessary because when the scripts runs again, you can just see the time and then check the EV again. But maybe someone else here have a better way to do it/this. 

Kas may have resolved the problem with a deep scan Will come back here to update

 

It's strange though that Norton, Bitdefender and Avast couldn't identify these but Kas did

 

[Vibes NoVibes]

3 hours ago, Vibes NoVibes said:

Every couple of hours I see a powershell script pop up and vanish which makes me think I may have some virus/malware on my system. I have premium versions of Norton and BitDefender but both aren't able to take care of the issue. Also downloaded trial versions for Avast and Kas but no relief.

 

What else could I try out here?

It's still happening. Someone please advice

[Franck]

2 hours ago, Vibes NoVibes said:

It's still happening. Someone please advice

there is no javascript that will have taken control of powershell. Check the details of the windows event. It will at least tell you the source and location of the script

[Vibes NoVibes]

32 minutes ago, Franck said:

there is no javascript that will have taken control of powershell. Check the details of the windows event. It will at least tell you the source and location of the script

Thanks a lot!

 

Where exactly should I look for details in the Event Viewer? I am sorry I am not an advanced user.

[BetteBalterZen]

1 hour ago, Vibes NoVibes said:

Thanks a lot!

 

Where exactly should I look for details in the Event Viewer? I am sorry I am not an advanced user.

What does it say under General and Details? Don't mind the Danish

[Vibes NoVibes]

On 12/1/2022 at 12:11 AM, BetteBalterZen said:

What does it say under General and Details? Don't mind the Danish

This is what I have under Apps and Service Logs > MSFT > Windows > PowerShell > Operational

 

 

Under details:

 

Log Name:      Microsoft-Windows-PowerShell/Operational
Source:        Microsoft-Windows-PowerShell
Date:          2 - December 6.57.19 PM
Event ID:      40961
Task Category: PowerShell Console Startup
Level:         Information
Keywords:      None
User:          THE-PRODIGAL-SO\vibes
Computer:      The-Prodigal-Son
Description:
PowerShell console is starting up
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-PowerShell" Guid="{a0c1853b-5c40-4b15-8766-3cf1c58f985a}" />
    <EventID>40961</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>4</Task>
    <Opcode>1</Opcode>
    <Keywords>0x0</Keywords>
    <TimeCreated SystemTime="2022-12-02T13:27:19.0173907Z" />
    <EventRecordID>45976</EventRecordID>
    <Correlation ActivityID="{80ce38e3-0649-0004-0f02-cf804906d901}" />
    <Execution ProcessID="19640" ThreadID="11828" />
    <Channel>Microsoft-Windows-PowerShell/Operational</Channel>
    <Computer>The-Prodigal-Son</Computer>
    <Security UserID="S-1-5-21-4003650699-2997734460-1492051224-1001" />
  </System>
  <EventData>
  </EventData>
</Event>

[Vibes NoVibes]

1 minute ago, Vibes NoVibes said:

This is what I have under Apps and Service Logs > MSFT > Windows > PowerShell > Operational

 

 

Under details:

 

Log Name:      Microsoft-Windows-PowerShell/Operational
Source:        Microsoft-Windows-PowerShell
Date:          2 - December 6.57.19 PM
Event ID:      40961
Task Category: PowerShell Console Startup
Level:         Information
Keywords:      None
User:          THE-PRODIGAL-SO\vibes
Computer:      The-Prodigal-Son
Description:
PowerShell console is starting up
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-PowerShell" Guid="{a0c1853b-5c40-4b15-8766-3cf1c58f985a}" />
    <EventID>40961</EventID>
    <Version>1</Version>
    <Level>4</Level>
    <Task>4</Task>
    <Opcode>1</Opcode>
    <Keywords>0x0</Keywords>
    <TimeCreated SystemTime="2022-12-02T13:27:19.0173907Z" />
    <EventRecordID>45976</EventRecordID>
    <Correlation ActivityID="{80ce38e3-0649-0004-0f02-cf804906d901}" />
    <Execution ProcessID="19640" ThreadID="11828" />
    <Channel>Microsoft-Windows-PowerShell/Operational</Channel>
    <Computer>The-Prodigal-Son</Computer>
    <Security UserID="S-1-5-21-4003650699-2997734460-1492051224-1001" />
  </System>
  <EventData>
  </EventData>
</Event>

One more log under Apps and Services Logs > OpenSSH > Windows PowerShell

 

 

[BetteBalterZen]

@Vibes NoVibes Hmm, doesn't really say much... Not sure where to go from here. Maybe someone else here have an idea

[BetteBalterZen]

@Vibes NoVibes if you open Task Scheduler, do you see any weird folders here? 

[Vibes NoVibes]

4 hours ago, BetteBalterZen said:

@Vibes NoVibes if you open Task Scheduler, do you see any weird folders here? 

I don't think so

[BetteBalterZen]

5 hours ago, Vibes NoVibes said:

I don't think so

You are in the Event Viewer and not Task Scheduler

[Vibes NoVibes]

3 hours ago, BetteBalterZen said:

You are in the Event Viewer and not Task Scheduler

Update : I just realized this and went to Task Scheduler. Disabled a PowerShell entry for Windows and haven't seen the popup yet which is obviously a good sign.

 

Quick point though - this task was never scheduled before any malwares hit my system so shouldn't it have gone away automatically when the malwares were detected and deleted?

[BetteBalterZen]

8 minutes ago, Vibes NoVibes said:

Update : I just realized this and went to Task Scheduler. Disabled a PowerShell entry for Windows and haven't seen the popup yet which is obviously a good sign.

 

Quick point though - this task was never scheduled before any malwares hit my system so shouldn't it have gone away automatically when the malwares were detected and deleted?

That is good to hear!

Can you inspect the task and see what PS script it tries to run? Maybe it will specify a location of where the script once was located. This could confirm the script was deleted by Anti-Virus, if no script can be found. 

Anyhow, if no script can be located and this task is left over junk from malware, just delete the task manually. 

[Vibes NoVibes]

7 minutes ago, BetteBalterZen said:

That is good to hear!

Can you inspect the task and see what PS script it tries to run? Maybe it will specify a location of where the script once was located. This could confirm the script was deleted by Anti-Virus, if no script can be found. 

Anyhow, if no script can be located and this task is left over junk from malware, just delete the task manually. 

 

It was an entry related to DirectX. Below is the screenshot. 

 

Thanks so much mate for staying on top of this one! Really appreciate the support.

 

[BetteBalterZen]

6 minutes ago, Vibes NoVibes said:

 

It was an entry related to DirectX. Below is the screenshot. 

 

Thanks so much mate for staying on top of this one! Really appreciate the support.

 

Fantastic! And you are welcome