Strange login event, windows 11

[FNKLM]

Hello support!
Recently a new strange event has started to accour when I login in to my user account on windows 11.
Not every time but often when I login either a powershell window pop up and disappear. Or a transparent powershell window pop up and stay there until closed.
Have googled the issue and the probable cause would be that powershell is mistakenly put on autostart. 
Have checked the auto start folder and it is not present and on the activity manager powershell is set as inactive on start.
Have searched the computer with windows own virus search and malwarebytes and have not got any warnings.
Do you have any idea what it might be? Or how to solve it?

Kind regards

[Maurice Naggar]

Hello 

I will guide you. Please do these first steps https://forums.malwarebytes.com/topic/9573-im-infected-what-do-i-do-now/#comment-46166

 

[FNKLM]

Hello, have attached the asked information. Please tell if I missed any information or if you need additional information.

Kind regards

malwarebyte.txt Addition.txt FRST.txt

[Maurice Naggar]

Hi. This can help to remove some bloatware added from Lenovo. 

Let's do one scan with Malwarebytes Adwcleaner to check for adwares. Just before pressing that "scan" button, be sure that Chrome & Edge, or other web browser are Closed.

It will not take much time,

First download & save it
guide & download link

Then be sure to close all web browsers after the download & before launching the tool.

Then go to where the EXE file is saved. Start Adwcleaner.  Then do a scan with Adwcleaner

Guide article

Attach the clean log from Adwcleaner when all completed.

[Maurice Naggar]

Hello @FNKLMBe sure to do the ADWCLEANER tips listed above.What follows is a custom script intended to help out overall.

Take these actions so that Windows 11 is set to show all hidden files and folders.
Open File Explorer from the taskbar.

Select View > Show > Hidden items.

Select View → Show → File name extensions

Please be sure to Close any open work files, documents,  any apps you started yourself  before starting this. THIS run will do a Windows RESTART. Once it starts it will auto-close any other running app.

We will use FRST64.exe  on the Downloads folder to run a custom script.    The system will be rebooted after the script has run. This is intended to do some system checks using System File Checker ( SFC ) & the Windows 11 DISM check tool and a quick scan with MS Defender. It will also rebuild the Winsock. It will clear the cache temporary files of the web browsers.

This custom script is for  FNKLM  machine  only / for this machine only.

• Please save the (attached file named) FIXLIST.txt   to the   Downloads   folder

fixlist.txt    <<< - - - - -

Then, Start the Windows Explorer and then, go  to the Downloads    folder.

RIGHT click on FRST64.exe    and select RUN as Administrator and allow it to proceed.  Reply YES when prompted to allow to run.

•    If the tool warns you the version is outdated, please download and run the updated version.
• IF Windows prompts you about running this, select YES to allow it to proceed.
• IF you get a block message from Windows about this tool......

               click line More info information on that screen
               and click button Run anyway on next screen.

• on the FRST window:

Click the Fix button just once, and wait.

PLEASE have lots and lots of patience when this starts. You will see a green progress bar start. Lots of patience.  Please attach the Fixlog.txt with your next reply. 

Edited October 27, 2022 by Maurice Naggar
updated

[FNKLM]

Hello again,
here are the requested files.
ADWCleaner might have found a false positive, it flagged a registry key for a software named Claro.
Have visited here once before and then they connected that key to the Claro software.
Since I need that software to work I have not deleted that key, other than that followed the instructions to the letter.

 

 

Fixlog.txt AdwCleaner[C01].txt

[Maurice Naggar]

Hello, Thank you for the reports. The custom-fix run is very good. This shows that the Microsoft Defender is in very fine condition. As are other key services for Windows.
What about today. Have you seen a stray powershell command-prompt-window ?

[FNKLM]

Hello again, thank you for the help!
The behavior is unfortunately still present.
Do you know what the next step might be?

[Maurice Naggar]

I would emphasize to reduce the auto-started applications that start with Windows down to the absolute minimum. Which would basically be just security applications.
Apply these principles now from the following How-to
How to perform a clean boot in Windows
https://support.microsoft.com/en-us/help/929135/how-to-perform-a-clean-boot-in-windows

[FNKLM]

Thank you for the guide, I will try to make a clean boot between semesters.
Thanks for the help!

[Maurice Naggar]

OK. You are welcome.

[Maurice Naggar]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread.

Please review the following to help you better protect your computer and privacy Tips to help protect from infection

Thank you