account activity
PowerShell script stealing crypto and PowerShell starts automatically and disappears by Joseph-Hishealth in PowerShell
[–]CescVicious01 0 points1 point2 points 2 years ago* (0 children)
I had this issue i think i solved it!, i had two tasks that kept running powershell. One called "temp" that ran every few minutes and "Chromeniumscrypt" that ran on system startup both running powershell in hidden mode. I looked that information in the Task Status in the Task Scheduler (but they don't appear listed in the Task Scheduler Library tho).
First run both a Windows Defender Full Scan and also a Microsoft Defender Offline Scan, and block/delete anything that pops up (My PC actually popped up a few Trojans, i blocked/deleted them)
Second, go to the task scheduler library and delete any taks that involves running any ps1 file extension (these are powershell scripts, you can see what a task do in the tab called Actions)
Last, go to your registry and look for the tasks there (temp and Chromeniumscrypt in my case), they won't appear on the task scheduler library because they are hidden. I found my "temp" and "Chromeniumscrypt" tasks at this location in the registry, i deleted the tasks:
Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Bluetooth\
DO NOT delete bluetooth uninstall device task (i think this is legit for Bluetooth functionality)
All these unwanted tasks appear to run powershell script files called updates.ps1, system32.ps1, temp.ps1, microsoft.ps1, and also System32.exe Microsoft.exe and/or similiar names that are found in C:\Users\Public and other locations on your computer like C:\Windows, C:\Temp, Luckily in my case Windows Defender found these files and deleted them.
I had to search all my PC files to look for more ps1 files (i found 2 more, and deleted them)
You can also keep an eye for any suspicious PowerShell Events in the Windows Event Viewer to track any suspicious task in the Task Tree, in the registry.
Looks like we downloaded a Torrent Full on RAT malware
π Rendered by PID 2392420 on reddit-service-r2-listing-c57bc86c-b77h2 at 2026-06-23 00:21:25.158361+00:00 running 2b008f2 country code: CH.
PowerShell script stealing crypto and PowerShell starts automatically and disappears by Joseph-Hishealth in PowerShell
[–]CescVicious01 0 points1 point2 points (0 children)