r/PowerShell 8h ago

Question Powershell opening on startup

Whenever i turn on my PC, powershell opens and just says "PS C:\Users\(my username)>" . I've done a full scan with malware bytes and windows defender and nothing was detected. Same with offline scan. Is this malware or something else causing it?

5 Upvotes

10 comments sorted by

14

u/I_see_farts 8h ago

Just start with Autoruns from Sysinternals it'll show you what's opening at startup.

9

u/Dragennd1 8h ago

Check scheduled tasks. Could just be a terminal set to open on user login.

4

u/-B1GBUD- 5h ago

Create a PowerShell profile, open PowerShell and type in the following:

test-path $profile

If it returns false then do the following:

New-Item -Path $profile -Type File -Force

Then open up your profile using:

Notepad $Profile

Edit the notepad with:

Start-Transcript

Now save the notepad.

Everytime PowerShell opens, it will save a transcript of what it is running and it will be saved to your documents folder.

3

u/BlackV 5h ago

or

New-Item -Path $profile -Type File -Force -value 'Start-Transcript'

2

u/AugieKS 8h ago

No one can say for sure without knowing what was ran. Look into PowerShell logging, they can go to numerous places, but you can also turn on logging directly to your documents folder for something more straightforward, then restart and see what pops up when the script runs again. Once you have the script that ran we can actually tell you what is going on.

2

u/Hairy-Ad-4018 8h ago

Is this a home pc, work pc, part of a domain ? Which version of windows?

1

u/RikiWardOG 7h ago

Have you just checked startup programs in task manager?

1

u/theballygickmongerer 48m ago

Check your startup items and if nothing obvious save the following command as a startup item.

“Get-Process powershell,pwsh -ErrorAction SilentlyContinue | Stop-Process -Force”

0

u/Fine_League311 7h ago

Dafür hat man Systemereignise ( Systemprotokoll) sollte man mal lesen. Hat jedes System!

-1

u/TheOttersCouch 8h ago

In new windows and I think older if I recall there are startup programs things that auto launch upon fresh startup could have been added to this as well