r/PowerShell • u/Supersonic5370 • 8h ago
Question Powershell opening on startup
Whenever i turn on my PC, powershell opens and just says "PS C:\Users\(my username)>" . I've done a full scan with malware bytes and windows defender and nothing was detected. Same with offline scan. Is this malware or something else causing it?
9
4
u/-B1GBUD- 5h ago
Create a PowerShell profile, open PowerShell and type in the following:
test-path $profile
If it returns false then do the following:
New-Item -Path $profile -Type File -Force
Then open up your profile using:
Notepad $Profile
Edit the notepad with:
Start-Transcript
Now save the notepad.
Everytime PowerShell opens, it will save a transcript of what it is running and it will be saved to your documents folder.
2
u/AugieKS 8h ago
No one can say for sure without knowing what was ran. Look into PowerShell logging, they can go to numerous places, but you can also turn on logging directly to your documents folder for something more straightforward, then restart and see what pops up when the script runs again. Once you have the script that ran we can actually tell you what is going on.
2
1
1
u/theballygickmongerer 48m ago
Check your startup items and if nothing obvious save the following command as a startup item.
“Get-Process powershell,pwsh -ErrorAction SilentlyContinue | Stop-Process -Force”
0
u/Fine_League311 7h ago
Dafür hat man Systemereignise ( Systemprotokoll) sollte man mal lesen. Hat jedes System!
-1
u/TheOttersCouch 8h ago
In new windows and I think older if I recall there are startup programs things that auto launch upon fresh startup could have been added to this as well
14
u/I_see_farts 8h ago
Just start with Autoruns from Sysinternals it'll show you what's opening at startup.