Tech Support ERA: PowerShell window pops up and quickly disappears

[Zoidberg Jesus]

I got a new EVOO Gaming Windows 10 laptop recently, and after booting up and logging in, about 8-10 minutes later, a PowerShell window will pop up in the middle of the screen and disappear in about a quarter of a second. In one instance, I have had it pop up in the middle of a game and distract me enough to effect my gameplay, so I want to figure out why it is happening and more importantly, how to stop it from happening. I have checked the start up folder, nothing suspicious there. I have looked over Event Viewer and Task Scheduler, nothing related there. I have done multiple virus scans, nothing detected. How can I fix this? I'll provide more information if needed. Thank you.

 

[BLEEN]

Try Task Manager>Startup tab

If not, try the Services tab on the right there. Open Services, bottom right. Open up that window and look at what starts immediately or delayed upon boot.

 

[Zoidberg Jesus]

Try Task Manager>Startup tab

If not, try the Services tab on the right there. Open Services, bottom right. Open up that window and look at what starts immediately or delayed upon boot.

Click to shrink...

The only thing I have enabled in Task Manager startup is Windows Security Notification Icon, I'll try temporarily disabling that and trying again. For Services, how can I tell which services start at boot up or soon after? Never mind, found it, I'll take a look.
Edit: Disabling Windows Security Notification Icon at startup didn't help, so I'll reenable that. I didn't see anything standing out to me in Services that would cause this.

 

[flyinj]

Do you have GOG Galaxy running? It pops up cmd shells sometimes when it autoscans for new games installed

Also,if you have any Logitech device drivers installed the background task constantly pops up an auto update window for like a quarter second every few hours that minimizes full screen apps

 

[Zoidberg Jesus]

Do you have GOG Galaxy running? It pops up cmd shells sometimes when it autoscans for new games installed

Also,if you have any Logitech device drivers installed the background task constantly pops up an auto update window for like a quarter second every few hours that minimizes full screen apps

Click to shrink...

I have GOG Galaxy installed, but not running at startup or when the pop up happens. I have a Logitech mouse, but I don't see any Logitech drivers installed in Device Manager or Programs and Apps.

 

[NaturalHigh]

Just doing a quick google search, there is a reddit post saying it could be related to Office.

Task Scheduler > Microsoft > Office > Right click "OfficeBackgroundTaskHandlerRegistration" > Disable

Click to shrink...

You could also try using Event Viewer to find out what it is but I have never used it and have no idea how, lol.

 

[Zoidberg Jesus]

Just doing a quick google search, there is a reddit post saying it could be related to Office.



You could also try using Event Viewer to find out what it is but I have never used it and have no idea how, lol.

Click to shrink...

I saw this, but I do not have OfficeBackgroundTaskHandlerRegistration in that folder in Task Scheduler. I've also looked at Event Viewer, and I can't see anything related to PowerShell happening at the time of the pop up.

 

[NaturalHigh]

I saw this, but I do not have OfficeBackgroundTaskHandlerRegistration in that folder in Task Scheduler. I've also looked at Event Viewer, and I can't see anything related to PowerShell happening at the time of the pop up.

Click to shrink...

Is there any chance it would show up as command prompt or cmd.exe?

I guess you could try recording your screen via OBS for a bit with task manager pulled up. Then whenever it pops you could go to the video file and pause it to see if you can get a file name or something.

 

[Sumio Mondo]

How to disable PowerShell in Windows 11/10

Learn how to block or disable the PowerShell using Security Policy or Local Group Policy Editor. You can also uninstall PowerShell 7.

www.thewindowsclub.com

Why PowerShell Opens On Start-up and How to Stop It

The reason PowerShell open on Startup is likely because you mistakenly added Windows PowerShell to the Start-up folder. Lean how to stop it.

www.itechguides.com

You can disable Powershell through Group Policy or via Local Security Setting or outright uninstall Powershell if needs be. Try the steps in either of the links, see if those help.

 

[Zoidberg Jesus]

How to disable PowerShell in Windows 11/10

Learn how to block or disable the PowerShell using Security Policy or Local Group Policy Editor. You can also uninstall PowerShell 7.

www.thewindowsclub.com

Why PowerShell Opens On Start-up and How to Stop It

The reason PowerShell open on Startup is likely because you mistakenly added Windows PowerShell to the Start-up folder. Lean how to stop it.

www.itechguides.com

You can disable Powershell through Group Policy or via Local Security Setting or outright uninstall Powershell if needs be. Try the steps in either of the links, see if those help.

Click to shrink...

Thanks. I have to go out now, but I'll try that later.

 

[Baji Boxer]

There's a file that contains a history of what PowerShell did in past sessions (storing history of the past 4096 commands), though I couldn't say off hand exactly where it is. Not in front of my PC, so can't explore or experiment at the moment. That might give an idea of what it's doing.

 

[Astral Lovelace]

How to disable PowerShell in Windows 11/10

Learn how to block or disable the PowerShell using Security Policy or Local Group Policy Editor. You can also uninstall PowerShell 7.

www.thewindowsclub.com

Why PowerShell Opens On Start-up and How to Stop It

The reason PowerShell open on Startup is likely because you mistakenly added Windows PowerShell to the Start-up folder. Lean how to stop it.

www.itechguides.com

You can disable Powershell through Group Policy or via Local Security Setting or outright uninstall Powershell if needs be. Try the steps in either of the links, see if those help.

Click to shrink...

While you're at it, make sure to delete Sys32, can never be too sure!

... Don't do this.

Check Task Scheduler, Event Viewer, and Startup. Don't go disabling valuable windows tools because you have a service that happens to use it and you haven't figured out which it is.

 

[Astral Lovelace]

There's a file that contains a history of what PowerShell did in past sessions (storing history of the past 4096 commands), though I couldn't say off hand exactly where it is. Not in front of my PC, so can't explore or experiment at the moment. That might give an idea of what it's doing.

Click to shrink...

This depends on the version of Powershell installed on the computer... v5 or higher has this, but it's no surprise to find v3 on systems.

*IF* it's v5 or higher, which it might be, this document can help you check that... *AFTER* you check your Task Scheduler.

Thanks. I have to go out now, but I'll try that later.

Click to shrink...

And I can't repeat this enough do not fucking do this, this is something that an organization would do for a kiosk or helpdesk computer.


If you have an Anti-virus installed, which you should, and you haven't noticed any other weird behavior, 99.99999999999999999999% chance it's some utility or driver or auto-updating *anything* that you have installed that's pulling it up.
DO NOT REMOVE POWERSHELL

 

[Zoidberg Jesus]

Ok, I won't remove or disable PowerShell. I'll see about looking through Task Scheduler and finding the past commands in PowerShell when I get home later.

 

[BLEEN]

Ok, I won't remove or disable PowerShell. I'll see about looking through Task Scheduler and finding the past commands in PowerShell when I get home later.

Click to shrink...

Yeah that's overkill disabling PS lol

Like when people stripout Cortana or Windows Updates completely. Easy way to FUBAR your install.

 

[Zoidberg Jesus]

I had an administrator PowerShell window open after I started up my laptop, and another PS window popped up and disappeared. Pressing the up arrow and entering Get-History in PS didn't show anything. I still don't see anything in Task Scheduler that looks like it would cause this. Here's a screenshot example I got by recording my screen in Powerpoint (all it shows is the path "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" in the title bar):

Edit: I did just find a task that matched up with the timing of the PS window popping up for THX software. I uninstalled this software previously, but now I also disabled all THX scheduled tasks (there was about 6 of them in a THX folder). It's looking good right now, so hopefully that was it.

Edit 2: I've rebooted a couple of times, no pop up. Thanks for the help, everyone. I'll post back if it comes back.