PowerShell starts with Windows, can't disable it from msconfig.exe

I have just figgured out there's a startup item in msconfig under the name of "Microsoft® Windows® Operating System". Apparently it launches the PowerShell with some weird arguments and I can't disable it. Here's a screenshot:


I can see it's something to do with a character string, and I'm afraid it's a keylogger.
What do you think? Is it a virus? If yes, how do I remove it?

P.S.: I've tried deleting the WindowsPowerShell folder under system32 but it requires permision from TrustedInstaller to remove, and it will just not let me take the ownership of the foler. Oh, and I've searched for it in "Add or remove programs" , it's not there.

Here's a screenshot of the registry key mentioned in the arguments

Looks nasty to me. The fact that the PowerShell line is using the Invoke-Expression (alias: iex) cmdlet already sets of alarms. This cmdlet allows for dynamic code to be run, which is rarely something your typical script needs to do.

If you cannot disable or remove this startup item from msconfig, I'd delete the registry key the PowerShell line mentions... But before you do that, run the below Command Prompt command and post here the data of this 'GAZADSLU' value in your registry, so we can figure out what exactly the PowerShell startup line is doing.

Code:

reg query "HKCU:\Software\Classes\FYTNHRWPQH" /v "GAZADSLU"

P.S.: Please do not delete the WindowsPowerShell folder. Windows likes it there.

Pyprohly said:

Looks nasty to me. The fact that the PowerShell line is using the Invoke-Expression (alias: iex) cmdlet already sets of alarms. This cmdlet allows for dynamic code to be run, which is rarely something your typical script needs to do.

If you cannot disable or remove this startup item from msconfig, I'd delete the registry key the PowerShell line mentions... But before you do that, run the below Command Prompt command and post here the data of this 'GAZADSLU' value in your registry, so we can figure out what exactly the PowerShell startup line is doing.

Code:

reg query "HKCU:\Software\Classes\FYTNHRWPQH" /v "GAZADSLU"

P.S.: Please do not delete the WindowsPowerShell folder. Windows likes it there.

I have just tried your command but gave me this error


Anyways, I have exported the registry key to a txt file using this command


The export.txt file is too large to uploadid on this site, so I'll upload it here: export.txt :: Free File Hosting - File Dropper: File Host for Mp3, Videos, Music, Documents.

I'd delete the registry key the PowerShell line mentions

Oh, by the way, that was the first thing that came into my mind, but when I try it says "Unable to delete all specified values". Any other way to get rid of it?

have you seen signs of infection recently?

Well, a few days ago I got one of my usb thumb drives virused with that common shortcut virus (from a library computer). I think it's because of that.

Looks like it's something else, but not Powerliks

Which is why I suggested:

You should probably have a Security expert scan your system... I am NOT an expert I just play one on TV

Urthboundmisfit said:

Which is why I suggested:

You should probably have a Security expert scan your system... I am NOT an expert I just play one on TV

Nah, I'll just make a little startup program to close PowerShell.