a PowerShell trojan that downloads extra payloads

When a malicious script quietly launches from behind a familiar application and reaches out to a remote server for more code, the infection usually travels through PowerShell. Australian households and small offices in suburbs from Parramatta to Fortitude Valley have reported variants that arrive inside cracked software bundles, fake ATO email attachments, or pirated game installers. Because the loader runs in memory rather than from a traditional executable, standard antivirus products sometimes leave the user thinking the machine is clean even while second-stage payloads are still being fetched.

The technique is often described as fileless or downloader-style, and the recovery path differs from clearing a typical virus. You are not just deleting an .exe file. You are hunting down scheduled tasks, WMI subscriptions, registry run keys, and obfuscated command strings that survive a reboot. The walkthrough below focuses on practical steps that work on Windows 10 and 11 devices commonly used across Australia, alongside a few tools worth installing if you handle infections regularly.

Recognising the warning signs on a compromised PC

A PowerShell downloader rarely announces itself. The most useful early indicator is hidden console windows flashing briefly in the taskbar while you are not doing anything obvious, followed by a sustained spike in powershell.exe CPU usage in Task Manager. On Telstra or Optus NBN connections, you may also notice steady upload activity even when no cloud backup is running, because the trojan is phoning home to receive follow-on modules.

Other clues include newly installed programs you did not authorise, browser redirects through odd search engines, and sluggish performance on machines that were previously fine. Some Australian victims have flagged fake "Australia Post" delivery SMS messages that lead to a shortcut file, which then drops a script calling PowerShell with -ExecutionPolicy Bypass. If you see any of this, treat the device as compromised until proven otherwise, and avoid logging into online banking apps like CommBank or ANZ until the cleanup is complete.

Immediate steps to limit the damage

Disconnect the affected machine from the network as soon as you suspect something is wrong. Pulling the Ethernet cable or turning off Wi-Fi stops further payload retrieval and prevents lateral movement to other devices in your home or office. If you run a small business in Adelaide or Perth and rely on cloud-hosted accounting software, log into that service from a known-clean device and rotate any passwords that were active on the infected workstation.

Next, boot into Safe Mode with Networking only if you need to download fresh anti-malware tools. Otherwise, plain Safe Mode is enough for an offline inspection. Run a full scan with a reputable secondary engine, since many downloaders are designed to evade the default Microsoft Defender. Keep a copy of the scan log, as the timestamps help correlate what was running when the trojan first touched disk. For guidance on layered cleanup, the broader process of pulling apart a memory-resident infection is covered in this fileless malware walkthrough, which pairs well with the PowerShell-specific steps below.

Detection layer	Strength	Weakness	Best fit
Microsoft Defender offline scan	Built-in, no install, good baseline	Can miss obfuscated scripts	First-line check
Malwarebytes free scan	Strong against downloaders	Real-time protection is paid	Quick second opinion
ESET Online Scanner	Heuristic PowerShell detection	Thirty-day licence only	Single deep clean
Sysmon plus manual log review	Catches parent-child PowerShell chains	Requires analyst time	Repeat infections
Autoruns from Sysinternals	Reveals persistence entries	No real-time blocking	Post-cleanup audit

Removing the PowerShell loader and its payloads

Start with Task Manager and look for any powershell.exe or pwsh.exe process that is not opened by you. Right-click and open the file location, then note the full path, since most droppers hide inside %AppData%, %Temp%, or C:\ProgramData. Open an elevated PowerShell prompt and run Get-ScheduledTask | Where-Object {$_.State -ne "Disabled"} | Export-ScheduledTask to dump what is scheduled to run. Anything pointing back to a suspicious folder or to powershell -WindowStyle Hidden -enc is part of the chain.

Clear the Temp folders, then remove the suspicious files. After that, open regedit and search under HKCU\Software\Microsoft\Windows\CurrentVersion\Run, HKLM\...\Run, and HKCU\...\RunOnce for entries that call PowerShell with encoded commands. Use Get-ItemProperty to inspect each value before deleting. Restart the machine and watch the resource monitor for a few minutes to confirm no new PowerShell window appears.

Cleaning persistence mechanisms and watching for browser tampering

Many PowerShell trojans also touch the browser so that future downloads land somewhere the attacker controls. Check installed extensions in Chrome, Edge and Firefox, remove anything you do not recognise, and reset the start page if it has been swapped. Trojans that tamper with bookmarks and push phishing URLs use a similar playbook, which is explained in detail in this guide on bookmark-modifying trojans.

Finally, audit WMI event subscriptions with Get-WMIObject -Namespace root\Subscription -Class __EventConsumer and remove any consumer that points to a script. Disable any local accounts you do not recognise, especially hidden ones created with a $ suffix. Run a second full scan, then re-enable network access one service at a time. If you still feel something is off, browse to the adware category archive for context on residual browser redirects that can mimic a fresh infection.

Recovery, hardening and everyday habits

Once the machine is clean, change every credential that was active on it, including email, banking, and any account using two-factor codes from an authenticator app on the same device. Apply the latest cumulative Windows updates, and enable Credential Guard if your edition supports it. For ongoing protection, configure Windows Defender to block unsigned script execution outside of your dev folders, and consider a paid real-time suite if your household runs multiple endpoints.

Small habits matter just as much. Avoid downloading "free" installers from file-hosting sites, treat unexpected ATO or myGov messages with suspicion, and keep an offline backup on an external drive that is unplugged when not in use. Joining the ACSC alert mailing list gives Australians an early heads-up on active campaigns, and reporting incidents to Scamwatch helps build a wider picture of how these trojans spread. With a layered routine in place, a PowerShell downloader loses most of its appeal.