I'm not using English Kaspersky.
Issue: powershell.exe repetitively marked as trojan, unable to remove completely.
OS: Windows 11
Kaspersky Plus

Context: Seems to be a trojan I got from running a bad .exe

Full process:

First running yesterday (Windows security detected and removed the supposed trojan right away)but haven't started until the first startup of today, powershell ran weird commands, my discord account was the first to get infected. Has already changed password, so far other account hasn't been infected yet. powershell hasn't started up ever since even if I were to try to restart my pc.

 A ScreenImage.png was created in temp folder, seems to be updated regularly, first generated the same time I started up my pc, I haven't restarted the pc since started doing a full scan with kaspersky, not sure whether it's stopped because of the scan or screenshots only taken after startup.

It seems that a registry key was removed related to powershell? I did find a suspicous powershell registry key manually but wasn't sure whether it's geniune, no longer find it, (kaspersky may had removed the very same registry.)

I'm not sure how should I proceed next, any help would be appreciated, can provide more information if needed.

...and maybe you'll find the time (before or after) to check what the 'UpdateHostsFile' command actually does. A modified ‘Hosts’ file can lead to strange results, such as unwanted downloads.

hi @SchulteHow can I verify whether it actually ran a command or not? It's not particularly important task anyways whatsoever so I'll just remove it to be safe! I actually recognize the software it tried to run in the Action tab but not sure if there's any other important points.

@harlan4096,
This is my result file using the link you sent me!
 

# -------------------------------
# Malwarebytes AdwCleaner 8.7.1.626
# -------------------------------
# Build:    02-20-2026
# Database: 2025-12-16.1 (Cloud)
# Support: https://help.malwarebytes.com/
#
# -------------------------------
# Mode: Scan
# -------------------------------
# Start:    03-15-2026
# Duration: 00:00:16
# OS:       Windows 11 (Build 26200.8037)
# Scanned:  32085
# Detected: 0

***** [ Services ] *****

No malicious services found.

***** [ Folders ] *****

No malicious folders found.

***** [ Files ] *****

No malicious files found.

***** [ DLL ] *****

No malicious DLLs found.

***** [ WMI ] *****

No malicious WMI found.

***** [ Shortcuts ] *****

No malicious shortcuts found.

***** [ Tasks ] *****

No malicious tasks found.

***** [ Registry ] *****

No malicious registry entries found.

***** [ Chromium (and derivatives) ] *****

No malicious Chromium entries found.

***** [ Chromium URLs ] *****

No malicious Chromium URLs found.

***** [ Firefox (and derivatives) ] *****

No malicious Firefox entries found.

***** [ Firefox URLs ] *****

No malicious Firefox URLs found.

***** [ Hosts File Entries ] *****

No malicious hosts file entries found.

***** [ Preinstalled Software ] *****

No Preinstalled Software found.

########## EOF - C:\AdwCleaner\Logs\AdwCleaner[S00].txt ##########
 

Even after removing the 'UpdateHostsFile', and run the tool, I'm still gettting issues from powershell.exe...
I don't know why but my reply is getting pending for approval
 

Hum maybe a false positive 🤔

Are there any other clues that may possibly prove this is a false positive? My accounts haven't been attacked since finished a full scan yesterday. Today's morning start up hasn't started powershell. I'm under the impression the AMSI Protection stopped the commands from actually running but I'm not even sure how AMSI actually work,... Can it even stop a command from running?
If it's clarified and most likely a false positive then I guess I can rest easy,
The latest full scan actually hasn't shown up anything in particular yet

Hello @QQxR,
You deleted the task, so no further insights are possible.

But for the sake of completeness:
We had different ideas about the “Action tab.” I was referring to this one (in your screenshot):
 

Spoiler

I'll leave the next steps to @harlan4096.

Thank you, @Schulte
Deleting the task really didn't stop the warnings
Just one last thing, when this is made sure to be a false positive, will the warnings in my logs stop, usually take how long? I don't like it when a genuine warning get mixed in with a bunch of false positive, well, if it's actually a false positive... just generally pretty hard to relax with this many warnings.
 
I'll keep following for a while for further steps if needed until it's fully confirm. If possible, to know the cause would be great for my sanity! I've been spending some time to do some readings online but there's barely any information with related issues.

Also 🤔 ?

Quote

Type: Trojan
Name: HEUR:Trojan-Downloader.BAT.Agent.gen

Application name: powershell.exe
Application path: C:\Windows\System32\WindowsPowerShell\v1.0
MD5 of an object: B3127F27D52B5A4B709C5ABD09B52141

Hi, What should I do next exactly? @Berny
Yes, the powershell.exe warnings in AMSI Protection hasn't stopped at all.

@harlan4096 @Schulte

? SFC  (Windows System File Checker) ? 

So,... I'd be following this tutorial here and run SFC with command prompt?
https://www.dell.com/support/contents/en-us/videos/videoplayer/how-to-run-system-file-checker/6333792850112

@QQxR

⚠️To a avoid a catastrophe please wait for additional  comments from  @harlan4096  and  @Schulte.

If it's a FP i personally  should disable Kapsersky before proceeding.

4 hours ago, QQxR said:

Are there any other clues that may possibly prove this is a false positive? My accounts haven't been attacked since finished a full scan yesterday. Today's morning start up hasn't started powershell. I'm under the impression the AMSI Protection stopped the commands from actually running but I'm not even sure how AMSI actually work,... Can it even stop a command from running?
If it's clarified and most likely a false positive then I guess I can rest easy,
The latest full scan actually hasn't shown up anything in particular yet

So finally no more powershell warning detections or They came again today?

There are still powershell warning detections today

Please go to Security -> Intrusion Prevention -> Manage Applications, and check if there are any app/entry in the restriction groups (Low / High / Untrusted)

This is the full list, there's low restricted but no restriction

I can't see well what's there, very low quality and very small texts...

I've just taken new screenshots in windowed mode, full screen seems to have smaller text and lower quality
These are the ones in Low Restricted, seems to just be my games

Do You trust in those 3 apps? Did You download from official site?

Yes, all of them are the official ones, they have been around for a while, I actually removed the files that got me infected already