Windows processes run several PowerShell scripts to perform several tasks required to run the system smoothly. However, sometimes this might trigger the PowerShell interface to open abruptly.
Most of the time, these pop-ups are caused by legitimate Windows processes. However, some applications or services may randomly run the script to make unsolicited changes to the system settings.
To prevent PowerShell from popping up, you need to determine if a scheduled task or a startup application or service is running a PowerShell script.
Check for Scheduled Task
Using the Task Scheduler, you can set a specific task to run when the system meets the required criteria.
The Task Scheduler may have a task that runs the PowerShell script, and if the trigger is set to repeat every few minutes, PowerShell will keep popping up.
- Press the Windows + R key to open Run.
- Type
taskschd.msc
and press Enter. This will open the Task Scheduler Window. - On the left panel, expand Task Scheduler Library.
- You will see a set of folders. Click on it to view all the scheduled tasks.
- Click on a task. The Task Scheduler will now display all the details about the selected task.
- Go to the Action tab and check its details to see if it is running a PowerShell script. The PowerShell script will have a
.ps1
extension. - Check the action tab on all the folders inside the Task Scheduler Library.
- Once you find the PowerShell script, right-click on the task and select Disable.
Some applications might need to run the PowerShell script to function. In such cases, you can change the triggers so the script does not run frequently. To change the triggers,
- Double-click on the Task that launches the PowerShell script.
- Go to the Triggers tab.
- Click on Edit. Here, you can change the settings that trigger the script.
- Once you set the desired configuration, click OK to save changes.
Use Autoruns
Checking individual folders on the Task scheduler library may be tedious, so you can instead use Autoruns to check tasks that might trigger a PowerShell Script. Autoruns allows users to get complete details about services, DLL files, scheduled tasks, and drivers that run on startup.
- Download Autoruns and Autorunsc.
- Extract the downloaded file and open the extracted folder.
- Right-click on
Autoruns.exe
and click on Run as Administrator. - Select Yes if it asks for confirmation.
- Go to the Everything tab.
- Check the Image Path column for any file with
.ps1
extention. - Once you find the file, check its corresponding Autoruns Entry and disable it.
- Restart your computer and check if you still get the PowerShell pop up.
Perform Clean Boot
Most of the time, checking the Task Scheduler and running the Autoruns should help you figure out the Powershell script responsible for popping up PowerShell.
But, services from a third-party application on your PC could also be launching a PowerShell script.
When you clean boot the system, your PC will not run any services except crucial Microsoft Services, helping you to figure out if any third-party services are causing the issue.
- Open Run.
- Type
msconfig
and then press Enter. This will open the System Configuration window. - Go to the Services Tab.
- Check Hide all Microsoft Services and click on Disable All.
- Click on Apply.
- Restart your PC and check if PowerShell pops up.
If the PowerShell still pops up, you can jump to the next solution. However, if the pop-up stops, you need to determine the service that is causing it.
- Open System Configuration.
- Go to the Services tab.
- Check Hide all Microsoft Services.
- Enable half of the services that you previously disabled.
- Restart the PC and check if the PowerShell pops up.
- If it does, the culprit service is among half of the services that you just enabled.
- Keep repeating this process until you find the service causing the pop-up.
Check Startup Application Using Task Manager
Several applications start automatically once the OS loads into the memory. These startup applications might be launching the PowerShell scripts. To disable them, you can disable the startup application.
- Open Task Manager by pressing the Ctrl + Shift + Esc key simultaneously.
- Go to the Startup tab.
- Click on an application with the status Enabled and click on Disable.
- Disable all the applications that have their status Enabled.
- Restart your PC and check if the PowerShell still pops up.
Full Scan Your Computer
Malicious applications on your PC could run PowerShell scripts randomly. To ensure this is not the case, we recommend that you perform a full PC scan.
- Open Run.
- Type
mrt
and press enter. - Click on Next.
- Check the Full scan and click on Next.
- Once the scanning completes, click on View detailed result of the scan to view the affected/malicious files.