neozbr
Member
- Downloaded
- 57.6 GB
- Uploaded
- 451.8 GB
- Ratio
- 7.84
- Seedbonus
- 30,903
- Upload Count
- 0 (0)
Member for 4 years
problem at 5:13 am already happened other days, I tried to see if there is something scheduled but did not find
problem: two powershell opens quickly then closes, out of nowhere without me having done anything, this happened already the other day
run powerhell
then conhost.exe
then svchost.exe
then smartscreen.exe
then consent.exe
I tried to find it in the task scheduler and saw nothing,
the first thing to happen is this:
Time of action Description File name Full path More info File Extension Data Source
30/05/2023 05:13:02 Task Run powershell.exe powershell.exe TouchpadSyncDataAvailableVBElS, \Microsoft\Windows\InputTouchpadSyncDataAvailableVBElS exe
then this:
Time of action Description File name Full path More information File Extension Data Source
05/30/2023 05:13:02 Task Run powershell.exe powershell.exe SystemSoundsServicemxFgC, \Microsoft\Windows\MultimediaSystemSoundsServicemxFgC exe
then two powershell windows open quickly:
Time of action Description File name Full path More information File Extension Data Source
30/05/2023 05:13:02 .EXE file executed POWERSHELL.EXE C:\Windows\System32\WINDOWSPOWERSHELL\v1.0\POWERSHELL.EXE Microsoft Corporation, Microsoft® Windows® Operating System, Windows PowerShell, 10.0.18362.2394 (WinBuild.160101.0800) EXE C:\WINDOWS\Prefetch\POWERSHELL.EXE-920BBA2A.pf
and open this twice:
Action Time Description File Name Full Path More Information File Extension Data Source
05/30/2023 05:13:02 .EXE file executed CONHOST.EXE C:\WINDOWS\SYSTEM32\CONHOST.EXE Microsoft Corporation, Microsoft® Windows® Operating System, Console Window Host, 10.0.18362.2394 (WinBuild.160101.0800) EXE C:\WINDOWS\PrefetchCONHOST.EXE-1F3E9D7E.pf
then this:
Time of action Description File name Full path More information File Extension Data Source
05/30/2023 05:13:02 .EXE file executed svchost.exe C:\Windows\System32\svchost.exe Microsoft Corporation, Microsoft® Windows® Operating System, Host Process for Windows Services, 10.0.18362.2394 (WinBuild.160101.0800) exe C:\WINDOWS\PrefetchSVCHOST.EXE-98090C0A.pf
then this:
Time of action Description File name Full path More information File Extension Data Source
05/30/2023 05:13:24 .EXE file executed SMARTSCREEN.EXE C:\WINDOWSSYSTEM32\SMARTSCREEN.EXE Microsoft Corporation, Microsoft® Windows® Operating System, Windows Defender SmartScreen, 10.0.19041.1 (WinBuild.160101.0800) EXE C:\WINDOWSPrefetchSMARTSCREEN.EXE-9B5E4173.pf
and finally this:
Action Time Description File Name Full Path More Information File Extension Data Source
05/30/2023 05:13:29 .EXE file executed CONSENT.EXE C:\WINDOWSSYSTEM32\CONSENT.EXE Microsoft Corporation, Microsoft® Windows® Operating System, Administrative Application Consent UI, 10.0.18362.2394 (WinBuild.160101.0800) EXE C:\WINDOWSPrefetchCONSENT.EXE-531BD9EA.pf
I don't know if it's a virus or something like that, can anyone tell me what it is?
I was in the middle of a game and out of nowhere it went to windows and powershell blinked twice and closed and I checked in last activity view and found what happened as I described.
how to deactivate it or stop it, does anyone know ?!
problem: two powershell opens quickly then closes, out of nowhere without me having done anything, this happened already the other day
run powerhell
then conhost.exe
then svchost.exe
then smartscreen.exe
then consent.exe
I tried to find it in the task scheduler and saw nothing,
the first thing to happen is this:
Time of action Description File name Full path More info File Extension Data Source
30/05/2023 05:13:02 Task Run powershell.exe powershell.exe TouchpadSyncDataAvailableVBElS, \Microsoft\Windows\InputTouchpadSyncDataAvailableVBElS exe
then this:
Time of action Description File name Full path More information File Extension Data Source
05/30/2023 05:13:02 Task Run powershell.exe powershell.exe SystemSoundsServicemxFgC, \Microsoft\Windows\MultimediaSystemSoundsServicemxFgC exe
then two powershell windows open quickly:
Time of action Description File name Full path More information File Extension Data Source
30/05/2023 05:13:02 .EXE file executed POWERSHELL.EXE C:\Windows\System32\WINDOWSPOWERSHELL\v1.0\POWERSHELL.EXE Microsoft Corporation, Microsoft® Windows® Operating System, Windows PowerShell, 10.0.18362.2394 (WinBuild.160101.0800) EXE C:\WINDOWS\Prefetch\POWERSHELL.EXE-920BBA2A.pf
and open this twice:
Action Time Description File Name Full Path More Information File Extension Data Source
05/30/2023 05:13:02 .EXE file executed CONHOST.EXE C:\WINDOWS\SYSTEM32\CONHOST.EXE Microsoft Corporation, Microsoft® Windows® Operating System, Console Window Host, 10.0.18362.2394 (WinBuild.160101.0800) EXE C:\WINDOWS\PrefetchCONHOST.EXE-1F3E9D7E.pf
then this:
Time of action Description File name Full path More information File Extension Data Source
05/30/2023 05:13:02 .EXE file executed svchost.exe C:\Windows\System32\svchost.exe Microsoft Corporation, Microsoft® Windows® Operating System, Host Process for Windows Services, 10.0.18362.2394 (WinBuild.160101.0800) exe C:\WINDOWS\PrefetchSVCHOST.EXE-98090C0A.pf
then this:
Time of action Description File name Full path More information File Extension Data Source
05/30/2023 05:13:24 .EXE file executed SMARTSCREEN.EXE C:\WINDOWSSYSTEM32\SMARTSCREEN.EXE Microsoft Corporation, Microsoft® Windows® Operating System, Windows Defender SmartScreen, 10.0.19041.1 (WinBuild.160101.0800) EXE C:\WINDOWSPrefetchSMARTSCREEN.EXE-9B5E4173.pf
and finally this:
Action Time Description File Name Full Path More Information File Extension Data Source
05/30/2023 05:13:29 .EXE file executed CONSENT.EXE C:\WINDOWSSYSTEM32\CONSENT.EXE Microsoft Corporation, Microsoft® Windows® Operating System, Administrative Application Consent UI, 10.0.18362.2394 (WinBuild.160101.0800) EXE C:\WINDOWSPrefetchCONSENT.EXE-531BD9EA.pf
I don't know if it's a virus or something like that, can anyone tell me what it is?
I was in the middle of a game and out of nowhere it went to windows and powershell blinked twice and closed and I checked in last activity view and found what happened as I described.
how to deactivate it or stop it, does anyone know ?!