News, tips, advice, support for Windows, Office, PCs & more
Home icon Home icon

We're community supported and proud of it!

  • Weird PowerShell Executable

    Home » Forums » Developers, developers, developers » DevOps Lounge » Weird PowerShell Executable

    Author
    Topic
    #2404720

    Hey Y’all,

    I ran into a problem that had me stumped for a while and I’m still don’t know how it happened in the first place.

    I tried to start the command line version of Windows PowerShell (PowerShell.exe) from the search menu on Start (Note I’m using Win 10 21H1 and Classic Shell)
    PowerShell-Search-Result
    Clicking on that entry resulted in…
    PowerShell-Error-Msg
    Now I know that this shouldn’t have happened because I could start it from my taskbar menu system in Administrator mode w/o problem, but I wanted to start it in user mode to test some code as a user when I got the bogus message.
    I then tried to start it by going to the file in File Explorer: C:Windows\System32\WindowsPowerShellv\1.0\PowerShell.exe and low and behold it started right up loading my profile and everything!

    Now this was starting to really bug me so I tried the search again but this time I used the right-click menu to look at it’s properties and this is what I found.
    BogusPowerShell
    Yes a zero length PowerShell.exe in C:Windows\System32 and this is the only one that showed up in the search, note it does NOT have the PowerShell Icon. Believe me I have absolutely no idea how this file was created and as you can see it was created back in September! I checked my test rig (same setup) and it worked normally. I also tested my laptop and it worked normally also.

    Anyone have any Idea how this happened?  However, I did just find this explanation but it doesn’t explain why it happened on only one of three machines.

    Inquiring minds want to know…LOL!

    May the Forces of good computing be with you!

    RG

    PowerShell & VBA Rule!
    Computer Specs

    • This topic was modified 1 month, 2 weeks ago by RetiredGeek.
    • This topic was modified 1 month, 2 weeks ago by RetiredGeek.
    Viewing 0 reply threads
    Author
    Replies
    • #2404834

      RG -Your post has fallen foul of the forum software glitch that removes backslashes from filepaths. 🙁

      At a guess, the zero-byte powershell.exe file in %SystemRoot%\System32 is just a placeholder left over from a Windows Update error after a temporary copy of powershell.exe was created (and used as part of the updating process).

      Unfortunately, confirming an update error will take some work as it will involve first generating a WindowsUpdate.log file from the Event Trace (.etl) files. This is very easy to do but the amount of information that ends up in a folder on your desktop is huge!

      If this info doesn’t make it readable for you to work out what happened (around the time the Date modified of the placeholder file changed) then possibly analyse it with the SetupDiag tool.

      More info can be found here:

      Windows Update log files

      Get-WindowsUpdateLog

      SetupDiag (I’ve never used this myself.)

      Hope this helps…

    Viewing 0 reply threads
    Reply To: Weird PowerShell Executable

    You can use BBCodes to format your content.
    Your account can't use all available BBCodes, they will be stripped before saving.