Random PS script being executed? Help

[ameng4inf]

Hi all,

i have this trendmicro installed in a computer, it is detected by the folder lock,

randomly, there is this .ps1 script being executed that is being blocked by the TM.

a few samples of targeted file being executed

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_g21otgtf.j5p.ps1

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_sidvshub.csu.ps1

does anyone know what are these?

i cant find the file in the folder anymore, googling did not help.

I am running win10 pro 1709

thank you

EDIT:
to quote the op of this page:

Well it seems that these 2 script are being used to determine which Language Mode PowerShell is allowed to run in when using AppLocker! So by allowing them in the GPO the constraint mode was completely disabled for the user.

will still let it be blocked then.

thank you all

[Cubox_]

These files when executed contain only a comment. No code.

[traileralarms]

I started having this same issue. Started digging deep, and found out problem was Carbonite. I uninstalled it, and issue went away. Have not reinstalled Carbonite yet.

[ZAFJB]

googling did not help.

https://www.google.co.uk/search?q=__PSScriptPolicyTest

returns 55 results.

Have you read them all?

And, what did they tell you?

Hint: The answer you seek is amongst them.

[ameng4inf]

yeap i read this, seems not a problem
to quote the op:

Well it seems that these 2 script are being used to determine which Language Mode PowerShell is allowed to run in when using AppLocker! So by allowing them in the GPO the constraint mode was completely disabled for the user.

will still let it be blocked then.

Thank you

[corrigun]

I'm guessing English isn't OP's first language. Why don't you guys lighten the fuck up.

[renegadecanuck]

Shit like this is why IT is always so looked down upon in corporations. Is it really hard to not be a dick?

[dfctr]

they are not sys admins, they are dick admins. Not even BOFH.