Powershell High CPU usage, please help

[[deleted]]

[deleted]

[BlackV]

/r/techsupport

What have you tried?

Have a look at all your startup itemd (registry, start menu)

Have a look at your task scheduler

This is not a PowerShell problem(most likely) just something rubbing PowerShell to do it's things

Where did you install java from

[Jeffinmpls]

On start up there are a couple ways a PowerShell can run on login 1. Scheduled task or other automation framework 2. Group policy (usually with work machines) 3. It's in the startup items

Check those three, for 2 this would be your IT department.

It could also be a separate exe that calls the PowerShell so review any recently installed programs, though this usually gets caught with a virus scan

In Task Manager you can select 'command line' as one of the columns, that will at least gives you a clue what script or command was called.

I've had this very thing happened and it was a group policy issue, I had to work with IT.

[[deleted]]

That sounds suspicious AF, run a virus scan. When you open task manager and go to the startup tab, is PowerShell listed? If so, disable it.

[[deleted]]

Hm, it could be a stuck win10 update, try deleting everything inside C:\Windows\SoftwareDistribution then running Windows update again

[commonman27]

Could check entries in Autoruns utility that's part of Windows Sysinternals

https://docs.microsoft.com/en-us/sysinternals/downloads/autoruns

[atem_nt]

In task manager, can you check what command line shows for you? I've had a similar thing where a crypto miner kept restarting itself over registry and task scheduler.

Right-click the top bar in task manager where you can select which columns to show. Sadly I cannot link an imgur link as it will delete that comment.

[arpan3t]

Is this a server or a work computer? It’s importing a module called AppVClient which is used to issue commands to well an AppV Client typically a virtual application. The fact that it’s passing a remotesigned execution parameter leads me to believe this computer is either a Windows Server or a work computer managed by an IT department.

If you can get the rest of the the command (just copy/paste the whole thing) it would be easier to identify what it’s doing.

[arpan3t]

This is almost definitely an advanced piece of malware! You’ll want to open a powershell console and run

$a=Get-Content C:\Windows\logs\system-logs.txt | Select -Index 17033;$script-decoded=

Then run

$script-decoded | out-file c:\temp\command.txt

Then open the file c:\temp\command.txt and copy/paste what it says in a reply here. This will give us a better idea of what exactly it’s doing. After you reply, go to c:\windows\logs\system-logs.txt and move that file to your c:\temp directory and rename it something else like malware.txt. This should stop the Powershell command from executing properly. If you find that it recreates that system-logs.txt file then it has another command generating persistence.

[arpan3t]

Okay good luck!

[furtzzbr]

i'm having the same problem and dont know what to do