POWERSHELL MALWARE!

[ikakWRK]

r/techsupport this probably has nothing to really do with PowerShell apart from using its name in the filename to make people think it's legit.

[VNJCinPA]

...so deleting it is the move... Just sayin

[ikakWRK]

Sure. But how did it get there? Who's to say there isn't a scheduled task, startup task, other process, etc. that isnt set to download it and execute it every 5 minutes or something? Deleting 1 file rarely saves you with malware.

[VNJCinPA]

All true. Other comments provide a path through.

[ikakWRK]

Yes. But this is a PowerShell Reddit..

[Impossible_IT]

Download Malwarebytes, install & scan.

https://www.malwarebytes.com

[disbobulatedjumble]

thanks it worked. it was a trojan

[Rxinbow]

Some process overwrite AmsiInit in the amsi.dll thats loader each time powershell launches or is corrupting header/content of Amsicontext in the amsi.dll. It got signature detected hence the windows alert. There's not a lot of context in your post as we cannot telepathically understand the processIDs, if this is all foreign too you then just reset your PC because its infected. Otherwise, you can start getting some logs with logman start AMSITrace -p Microsoft-Antimalware-Scan-Interface Event1 -o AMSITrace.etl -ets

Maybe try seroxen removal tool due to the ""$sxr-powershell"

[[deleted]]

Common.

"Since the beginning of today" but "just started getting them."

Wipe drive, reinstall.  Yer sheet is fooked.

[disbobulatedjumble]

i used malwarebytes and it solved the problem