[Tha Sneak]

⚡ PowerShell Scripting for Malware Removal ⚡

PowerShell is a powerful scripting tool that can help remove malware, analyze system infections, and harden security settings. This guide will teach you how to use PowerShell for malware detection and removal.

🔍 Step 1: Run PowerShell as Administrator

To execute scripts with full system access:
1️⃣ Press Win + X, then select Windows Terminal (Admin) or PowerShell (Admin).
2️⃣ If prompted by User Account Control (UAC), click Yes.

To check the PowerShell version, run:

Code

$PSVersionTable.PSVersion

Ensure you are using PowerShell 5.1 or later for maximum compatibility.

⚠️ Step 2: Enable Execution of Scripts (If Blocked)

By default, PowerShell restricts script execution. To enable it, run:

Code

Set-ExecutionPolicy Unrestricted -Scope CurrentUser

To allow signed scripts only (more secure):

Code

Set-ExecutionPolicy RemoteSigned

To check the current policy:

Code

Get-ExecutionPolicy

🦠 Step 3: Detect and Terminate Malicious Processes

Run the following command to list suspicious processes:

Code

Get-Process | Sort-Object CPU -Descending | Select-Object -First 20

To kill a process by name:

Code

Stop-Process -Name "maliciousprocess" -Force

To kill a process by Process ID (PID):

Code

Stop-Process -Id 1234 -Force

Use this to scan for unknown or high-CPU usage processes and terminate them.

📂 Step 4: Identify and Remove Suspicious Startup Items

Malware often persists by adding itself to startup locations. Run:

Code

Get-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run"

To remove a suspicious startup entry:

Code

Remove-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run" -Name "MalwareName" -Force

Also check for scheduled tasks:

Code

Get-ScheduledTask | Where-Object {$_.TaskPath -like "*Malware*" }

To delete a suspicious task:

Code

Unregister-ScheduledTask -TaskName "MalwareTask" -Confirm:$false

🛡 Step 5: Scan for Malware Files

To find suspicious files in common malware locations, run:

Code

Get-ChildItem -Path "C:\Users\*\AppData\Local\Temp","C:\ProgramData" -Recurse -ErrorAction SilentlyContinue |
Where-Object { $_.Extension -in ".exe", ".bat", ".vbs", ".js", ".cmd" } |
Select-Object FullName, LastWriteTime | Format-Table -AutoSize

To delete a suspicious file:

Code

Remove-Item -Path "C:\Path\To\Malware.exe" -Force -ErrorAction SilentlyContinue

To delete all executables in Temp folders:

Code

Remove-Item -Path "C:\Users\*\AppData\Local\Temp\*.exe" -Force -ErrorAction SilentlyContinue

🛠 Step 6: Reset Network & Firewall Settings (Fix Hijacked Settings)

If malware has modified your proxy settings, reset them:

Code

netsh winhttp reset proxy

To reset the DNS settings:

Code

Set-DnsClientServerAddress -InterfaceIndex (Get-NetAdapter | Select-Object -First 1).InterfaceIndex -ResetServerAddresses

To reset Windows Firewall rules:

Code

netsh advfirewall reset

🔍 Step 7: Check & Remove Rogue Services

List non-Microsoft services:

Code

Get-Service | Where-Object { $_.StartType -eq "Auto" -and $_.Status -eq "Running" -and $_.Name -notmatch "Microsoft|Windows" } |
Select-Object Name,DisplayName | Format-Table -AutoSize

To stop and delete a suspicious service:

Code

Stop-Service -Name "MalwareService" -Force
sc.exe delete MalwareService

🚀 Step 8: Run Windows Defender Quick Scan

Use Windows Defender's built-in PowerShell commands for scanning:

Code

Start-MpScan -ScanType QuickScan

For a full scan:

Code

Start-MpScan -ScanType FullScan

To update Defender before scanning:

Code

Update-MpSignature

🔄 Step 9: Restore System Integrity (Fix Corrupt Files)

If malware has corrupted system files, run:

Code

sfc /scannow

For deeper corruption issues, use:

Code

DISM /Online /Cleanup-Image /RestoreHealth

💡 Step 10: Hardening Your System Against Malware

After removing malware, take these steps to prevent future infections:

✅ Enable Controlled Folder Access (prevents ransomware):

Code

Set-MpPreference -EnableControlledFolderAccess Enabled

✅ Block unsigned scripts from running:

Code

Set-ExecutionPolicy AllSigned

✅ Disable automatic execution of removable media:

Code

Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" -Name NoDriveTypeAutoRun -Value 255 -Force

✅ Enable Windows Defender's real-time protection:

Code

Set-MpPreference -DisableRealtimeMonitoring 0

🎯 Conclusion

PowerShell is a powerful tool for malware detection and removal. This guide provides commands to help you:
✔️ Kill suspicious processes
✔️ Remove malware from startup
✔️ Scan and delete malicious files
✔️ Reset network & firewall settings
✔️ Check & remove rogue services
✔️ Run Defender scans and restore system integrity

For further analysis, consider uploading suspicious files to VirusTotal:
📌 VirusTotal Online Scanner

⚠️ Always verify commands before running them. Misuse of PowerShell can harm your system.