4

I noticed a couple days ago in Task Manager that I have a powershell.exe process running. When I went to msconfig it has a really long command. Here it is:

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -noprofile -windowstyle hidden -executionpolicy bypass iex ([Text.Encoding]::ASCII.Get.String([Convert]::FromBase64string((gp'HKCU:\Software\Classes\SAJELFZIXHQTV').ADUXJH)));

This is really weird because just today a random process that I had problems with before showed up (maybe it's not connected with this but just saying) which is a virus and tried to download an unsecured driver, as Windows says, on my PC. Could anyone tell me something about this PowerShell process? It starts up on startup and it's always running. Again, I hope I don't sound ignorant, maybe it's just a normal startup process.

1
  • Can this be harmful? If yes, how do I get rid of it, and if not, is this process important to Windows so I can just make it stop running on startup? Commented Sep 19, 2016 at 21:27

1 Answer 1

9

This is almost certainly malicious.

Let's take it apart. It invokes Windows PowerShell (a legitimate and very useful command interpreter) without user customizations (-noprofile) in a hidden window (-windowstyle hidden), allowing the PowerShell session to run scripts regardless of the system policy (-executionpolicy bypass). It then runs this command:

iex ([Text.Encoding]::ASCII.Get.String([Convert]::FromBase64string((gp'HKCU:\Software\Classes\SAJELFZIXHQTV').ADUXJH)))

gp means Get-ItemProperty, which can be used to retrieve values of Registry keys, and that's what it's doing here. Apparently, there's a key called SAJELFZIXHQTV in your current user Software\Classes key. That key has a value called ADUXJH, the data in which is what gp retrieves. That data (evidently a string) is then Base64-decoded into a byte array (FromBase64String). Those bytes are then interpreted as ASCII text (ASCII.GetString). Bizarrely, there's an extra dot in the original, which should cause an error because the ASCII object has no member called Get. Given that the process sticks around, though, I suspect the extra dot is just a transcription error.

If that error wasn't there, the resulting text would be invoked as a PowerShell command (iex). In short, this command is designed to load an encoded script from the Registry and execute it. To see exactly what it's running, copy the above PowerShell command minus the iex and with the extra dot removed into a PowerShell prompt and run it. It will print the command that would be invoked. It almost certainly won't be benign.

You can stop that entry from auto-starting with the Autoruns tool. However, it's probably a good idea to do a deeper clean of your machine, since it's likely infected. Please see How can I remove malicious spyware, malware, adware, viruses, trojans or rootkits from my PC?

13
  • So, in short: this is a bad thing, right? Can you just explain what this thing is doing in a simpler way if it's possible? I'm a little worried right now since I've had this powershell process for a long time now and nothing has happened yet. Commented Sep 19, 2016 at 21:49
  • 3
    @VoLturyBey Yes, it's probably a bad thing. It loads an encoded command from the Registry and executes it in the background, which is a moderately sketchy thing to do. I can't know exactly what that command does because it's only present in your Registry. Could you run the PowerShell command I included (minus the iex and with the extra dot fixed) please? That will show us what it's doing.
    – Ben N
    Commented Sep 19, 2016 at 21:51
  • Can it harm my PC if I do that? Commented Sep 19, 2016 at 21:52
  • @VoLturyBey Without the iex, it will only show what it's already been running. That can't harm you, but what it's been doing is very likely malicious.
    – Ben N
    Commented Sep 19, 2016 at 21:53
  • 1
    @VoLturyBey If it was me, I would be cleaning my computer very soon, but if you're not worried about anything it's already done, then I wouldn't expect anything to change within a couple days.
    – Ben N
    Commented Sep 19, 2016 at 22:09

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .