Windows 10: Is my windows powershell also infected?

My friend was using my laptop and he clicked on a microsoft word file and Windows defender said that it was a threat so immediately we scanned it. He did not open the word file and I deleted the word file as well as the stated affected file in windows defender


Here's the status in the protection history




After that I decided to check event viewer to see what was going on and I saw this in the log:


Windows Defender Antivirus has detected malware or other potentially unwanted software.

For more information please see the following:

https://go.microsoft.com/fwlink/?linkid=37020&name=Trojan:Win32/Emotet.ARJ!MTB&threatid=2147747854&enterprise=0

Name: Trojan:Win32/Emotet.ARJ!MTB

ID: 2147747854

Severity: Severe

Category: Trojan

Path: file:_C:\Users\Mom Dad\AppData\Local\Temp\oFFIce2019\R_o2c8hj4.exe

Detection Origin: Local machine

Detection Type: Concrete

Detection Source: Real-Time Protection

User: LAPTOP-H1FST728\Mom Dad

Process Name: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Security intelligence Version: AV: 1.321.2085.0, AS: 1.321.2085.0, NIS: 1.321.2085.0

Engine Version: AM: 1.1.17300.4, NIS: 1.1.17300.4


I see in the Process name that it's powershell? Does that mean it's infected? Another warning states that the Process name was unknown:

Windows Defender Antivirus has detected malware or other potentially unwanted software.

For more information please see the following:

https://go.microsoft.com/fwlink/?linkid=37020&name=Trojan:Win32/Emotet.VC!MTB&threatid=2147757854&enterprise=0

Name: Trojan:Win32/Emotet.VC!MTB

ID: 2147757854

Severity: Severe

Category: Trojan

Path: file:_C:\Users\Mom Dad\AppData\Local\Temp\oFFIce2019\R_o2c8hj4.exe

Detection Origin: Local machine

Detection Type: Concrete

Detection Source: System

User: LAPTOP-H1FST728\Mom Dad

Process Name: Unknown

Security intelligence Version: AV: 1.321.2085.0, AS: 1.321.2085.0, NIS: 1.321.2085.0

Engine Version: AM: 1.1.17300.4, NIS: 1.1.17300.4


What should i do? I also hope I can solve this remediation incomplete problem in protection history

:)

 

steps taken for infected Pc's.


I was hoping someone could give me a list of step by step instructions you use as a guide to clean virus, malware...etc. so I can keep my PC clean if it gets infected.

thx

 

PowerShell instead of Commandline in Creators Update

Interestingly enough my personal laptop just got the update...and still has Command Prompt listed, not PowerShell...

Edit: Not that it matters...I use both regularly. *Toast :toast:

 

PowerShell randomly poping-up in tool bar

Hello,

Just to verify, do you have any scheduled tasks that uses Powershell? Scheduled tasks makes Powershell window appear periodically on your computer, therefore we suggest that you check the Task Scheduler. Here are the steps:

• Click on Start.
• In the search bar, type Task Scheduler and click on
  
  Task Scheduler in the results.
• Under Active Tasks, check for any tasks that use Powershell and the scheduled time.

If the issue still persist, we suggest that you run a Windows Defender scan to see if it will pick up any malware that the first scan missed.

Let us know the outcome.