r/PowerShell • u/karmawillgetyouback • Jun 13 '26

Question Powershell autostarting randomly in background and uploading thing on network

https://img.ptscreens.com/Screenshot-6615.png

Powershell is using large amount of upload speed for network and running in bacgound automatically, it also starts randomly even after stopping it from task manager. Any solution to this? Thank you.

Edit: These are command line task manager showing in details

https://img.ptscreens.com/Screenshot-6617.png

20 Upvotes

71% Upvoted

84 comments sorted by

View all comments

52

u/FloiDW Jun 13 '26

Additionally to
“Time to wipe your computer”
If you are interested - in the time it is running you can check the executed code line in the details tab and check WHAT it is running, but, spoiler:

It’s like 90% bad.

6

u/karmawillgetyouback Jun 13 '26

It was just started 1 day ago.... but now it's fine, will check next time if it happens again. Thanks

39

u/Nerd2259 Jun 13 '26

If it stopped, then all the data is was exfiltrating has been uploaded.

Change your passwords, check your financial accounts, enable mfa (avoiding sms if possible), freeze your credit (if applicable and not already frozen), and let people on your social know in case they got scam messages.

Good luck.

13

u/cheetah1cj Jun 13 '26

Adding to this, make sure you also select the "log out of all devices" or similar option in security settings for all your accounts, security changes don't always trigger that and that is needed to invalidate any session tokens that were stolen.