powershell virus

I would initially run Process Explorer - https://docs.microsoft.com/en-us/sysinternals/downloads/process-explorer 
This will give you the process that launched Powershell.exe from the process tree.

As it comes back, I would also run Process Monitor - https://docs.microsoft.com/en-us/sysinternals/downloads/procmon .  This will help track how it is being launched etc..

Regards

Jak

I would initially run Process Explorer - https://docs.microsoft.com/en-us/sysinternals/downloads/process-explorer 
This will give you the process that launched Powershell.exe from the process tree.

As it comes back, I would also run Process Monitor - https://docs.microsoft.com/en-us/sysinternals/downloads/procmon .  This will help track how it is being launched etc..

Regards

Jak

Hi Jak,

Thanks for your reply.

That is happened in our network, not one or some computers.

This is lot of computer need to run the application one by one.

Is sophos can do something make things simple?

Thanks a lot!

Chuck