Windows 10: Unknow Task scheduled that launches powershell with obfuscated command

Hello everyone, I've been noticing occasional flashes of the PowerShell window on my computer, which prompted me to investigate further. Upon investigation, I discovered that a PowerShell command is being executed. The command is heavily obfuscated, making it difficult to understand its purpose. Using Procmon.exe, I traced the parent process back to svchost, which seems to be launching the PowerShell instance through scheduled tasks. Although I've checked the Windows Task Scheduler, I couldn't find any suspicious tasks there. However, after looking through the currently running tasks, I identi

:)

 

How to "translate" a CMD scheduled task into a Powershell scheduled task?

I have a scheduled Task where an Admin Command Prompt opens up and runs SFC and DISM. Here are the actions I entered in the "Action" tab of Task Scheduler:

Program/script: %windir%\system32\cmd.exe

Add Arguments (optional) /k Dism.exe /online /Cleanup-Image /StartComponentCleanup&&sfc/scannow&&Dism /Online /Cleanup-Image /RestoreHealth&&sfc/scannow

I tried to run exactly the same scheduled task now on Powershell but with no luck. What do I need to do to "translate" this from CMD into Powershell in the Task Scheduler?

Any suggestions greatly appreciated.

 

PowerShell randomly poping-up in tool bar

Hello,

Just to verify, do you have any scheduled tasks that uses Powershell? Scheduled tasks makes Powershell window appear periodically on your computer, therefore we suggest that you check the Task Scheduler. Here are the steps:

• Click on Start.
• In the search bar, type Task Scheduler and click on
  
  Task Scheduler in the results.
• Under Active Tasks, check for any tasks that use Powershell and the scheduled time.

If the issue still persist, we suggest that you run a Windows Defender scan to see if it will pick up any malware that the first scan missed.

Let us know the outcome.

 

Windows Task Scheduler service not working

Hi Jetfire158,

Can you confirm that you are running an Administrator account while performing these steps?

For now, we can force the Task Scheduler service to run using the command prompt. Kindly follow these steps:

1. Press the Windows key to open the Start Menu, type Command Prompt or cmd in the Search box.
2. Right-click on Command Prompt, and then click Run as administrator. If you are prompted for an administrator password or for a confirmation, type the password, or click Yes.
3. At the command prompt, type the following command:
   Net Start Schedule and press Enter.

At this point, try launching the Task Scheduler again.

Let me know how it goes.