Windows Malware & Backdoor Scanner

1

⚡ One-Shot Full Scan — Copy, Paste, Enter

Paste the entire script into an Administrator PowerShell window and press Enter. Takes ~30–60 s.

Auto-detects OS version → Win7: 12 checks · Win10: 12 checks · Win11: +VBS & Secure Boot = 13 checks. Suspicious findings print in red, clean items in green.

$ErrorActionPreference='SilentlyContinue'
function ok($m)  { Write-Host "  [OK] $m" -ForegroundColor Green }
function warn($m){ Write-Host "  [!!] $m" -ForegroundColor Red }
function hdr($m) { Write-Host "`n=== $m ===" -ForegroundColor Cyan }

# ── Auto-detect Windows version ─────────────────────
$ver   = [System.Environment]::OSVersion.Version
$build = $ver.Build
$isWin7  = ($ver.Major -eq 6 -and $ver.Minor -eq 1)
$isWin11 = ($ver.Major -ge 10 -and $build -ge 22000)
$isWin10 = ($ver.Major -ge 10 -and $build -lt 22000)
if($isWin11){ $label="Windows 11" } elseif($isWin10){ $label="Windows 10" } else { $label="Windows 7" }
Write-Host "`n  Detected OS: $label (Build $build)" -ForegroundColor Yellow

hdr "1/12 System Info"
if($isWin7){ $os=Get-WmiObject Win32_OperatingSystem } else { $os=Get-CimInstance Win32_OperatingSystem }
ok "Host: $env:COMPUTERNAME  |  OS: $($os.Caption)  |  Last boot: $($os.LastBootUpTime)"

hdr "2/12 Currently Logged-On Users"
query user 2>$null | ForEach-Object { ok $_ }

hdr "3/12 Local Administrators Group"
if($isWin7){
  net localgroup Administrators 2>$null |
    Where-Object { $_ -notmatch "^(The command|---|\s*$|Alias|Comment|Members)" -and $_.Trim() -ne "" } |
    ForEach-Object {
      $n=$_.Trim()
      if($n -notmatch "^Administrator$"){ warn "Unexpected admin: $n" } else { ok $n }
    }
} else {
  Get-LocalGroupMember -Group "Administrators" | ForEach-Object {
    $n=$_.Name
    if($n -notmatch "($env:COMPUTERNAME\\Administrator|AzureAD\\|BUILTIN\\Administrators)"){
      warn "Unexpected admin account: $n"
    } else { ok $n }
  }
}

hdr "4/12 Suspicious Processes (running from Temp / AppData / Downloads)"
$suspPaths = "\\Temp\\|\\AppData\\Roaming\\|\\Downloads\\|\\Public\\"
if($isWin7){
  Get-WmiObject Win32_Process | Where-Object { $_.ExecutablePath } | ForEach-Object {
    if($_.ExecutablePath -match $suspPaths){ warn "PID $($_.ProcessId) | $($_.Name) | $($_.ExecutablePath)" }
    if($_.Name -match "^(svchost|lsass|csrss|winlogon|explorer)\.exe$" -and $_.ExecutablePath -notmatch "System32|explorer\.exe"){
      warn "MASQUERADE! PID $($_.ProcessId) | $($_.Name) | $($_.ExecutablePath)"
    }
  }
} else {
  Get-Process | Where-Object { $_.Path } | ForEach-Object {
    if($_.Path -match $suspPaths){ warn "PID $($_.Id) | $($_.Name) | $($_.Path)" }
  }
  Get-Process | Where-Object { $_.Name -match "^(svchost|lsass|csrss|winlogon|explorer)$" -and $_.Path -and $_.Path -notmatch "System32|explorer\.exe" } |
    ForEach-Object { warn "MASQUERADE! PID $($_.Id) | $($_.Name) | $($_.Path)" }
}

hdr "5/12 Established Outbound Connections"
$localNets  = "^(127\.|10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.|::1|0\.0\.0\.0)"
$dangerProc = "powershell|cmd|wscript|mshta|regsvr32|rundll32|certutil|bitsadmin"
if($isWin7){
  $pidMap = @{}
  Get-WmiObject Win32_Process | ForEach-Object { $pidMap[[int]$_.ProcessId] = $_.Name }
  netstat -ano 2>$null | Select-String "ESTABLISHED" | ForEach-Object {
    $cols = ($_ -replace '\s+',' ').Trim() -split ' '
    if($cols.Count -ge 5){
      $rAddr=$cols[2]; $rip=($rAddr -split ':')[0]
      $ownerPid=[int]($cols[4]); $pname=$pidMap[$ownerPid]
      if($rip -notmatch $localNets){
        $line="$pname (PID $ownerPid)  ->  $rAddr"
        if($pname -match $dangerProc){ warn $line } else { ok $line }
      }
    }
  }
} else {
  Get-NetTCPConnection -State Established | ForEach-Object {
    $rip=$_.RemoteAddress
    $proc=(Get-Process -Id $_.OwningProcess -EA SilentlyContinue).Name
    if($rip -notmatch $localNets){
      $line="$proc (PID $($_.OwningProcess))  ->  $rip`:$($_.RemotePort)"
      if($proc -match $dangerProc){ warn $line } else { ok $line }
    }
  }
}

hdr "6/12 Registry Run Key Persistence"
$runKeys=@(
  "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run",
  "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run",
  "HKLM:\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run",
  "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce",
  "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce"
)
foreach($k in $runKeys){
  if(Test-Path $k){
    (Get-ItemProperty $k).PSObject.Properties | Where-Object {$_.Name -notmatch "^PS"} | ForEach-Object {
      $v=$_.Value
      if($v -match "Temp|\\AppData\\Roaming|powershell.*-enc|-w.{0,3}hidden|-nop|cmd.*/c.*http|\.vbs|\.js$|mshta|regsvr32|rundll32"){
        warn "$($_.Name) = $v"
      } else { ok "$($_.Name) = $v" }
    }
  }
}

hdr "7/12 Scheduled Tasks (non-Microsoft, suspicious commands)"
$taskBad="Temp|AppData|powershell.*-enc|cmd.*/c.*http|-w.{0,3}hidden|mshta|wscript|cscript|regsvr32"
if($isWin7){
  $csv=schtasks /query /fo CSV /v 2>$null | ConvertFrom-Csv
  $csv | Where-Object { $_.'Status' -ne 'Disabled' -and $_.'Task To Run' -and $_.'Task To Run' -ne 'N/A' } | ForEach-Object {
    $cmd=$_.'Task To Run'; $name=$_.'TaskName'
    if($cmd -match $taskBad){ warn "[$name] $cmd" } else { ok "[$name] $cmd" }
  }
} else {
  Get-ScheduledTask | Where-Object {$_.State -ne "Disabled" -and $_.TaskPath -notmatch "^\\\\Microsoft\\"} | ForEach-Object {
    $acts=$_.Actions | ForEach-Object {"$($_.Execute) $($_.Arguments)"}
    $line="[$($_.TaskName)] $($acts -join '; ')"
    if(($acts -join '') -match $taskBad){ warn $line } else { ok $line }
  }
}

hdr "8/12 WMI Event Subscriptions (should be empty on clean systems)"
$wmiF=Get-WMIObject -Namespace root\subscription -Class __EventFilter -EA SilentlyContinue
$wmiC=Get-WMIObject -Namespace root\subscription -Class __EventConsumer -EA SilentlyContinue
if($wmiF){ $wmiF | ForEach-Object { warn "WMI Filter: $($_.Name) | $($_.Query)" } } else { ok "No WMI EventFilter subscriptions" }
if($wmiC){ $wmiC | ForEach-Object { warn "WMI Consumer: $($_.Name)" } } else { ok "No WMI EventConsumer subscriptions" }

hdr "9/12 Executables Modified in the Last 7 Days (Desktop / Temp / AppData)"
$dirs=@("$env:USERPROFILE\Desktop","$env:TEMP","C:\Windows\Temp","$env:APPDATA","$env:LOCALAPPDATA")
$found=$false
foreach($d in $dirs){
  if(Test-Path $d){
    Get-ChildItem $d -Include "*.exe","*.dll","*.bat","*.ps1","*.vbs","*.js","*.hta","*.cmd" -Recurse -EA SilentlyContinue |
    Where-Object {$_.LastWriteTime -gt (Get-Date).AddDays(-7)} |
    ForEach-Object { warn "Recent file: $($_.FullName) [$($_.LastWriteTime.ToString('yyyy-MM-dd HH:mm'))]"; $found=$true }
  }
}
if(-not $found){ ok "No new executables found in the last 7 days" }

hdr "10/12 Antivirus Status & Exclusions"
if($isWin7){
  $mse=Get-WmiObject -Namespace root\Microsoft\SecurityClient -Class AntimalwareHealthStatus -EA SilentlyContinue
  if($mse){
    if($mse.RealTimeProtectionEnabled){ ok "MSE real-time protection: ON" } else { warn "MSE real-time protection: OFF!" }
    if($mse.SignatureAge -gt 3){ warn "MSE signatures are $($mse.SignatureAge) days old" } else { ok "MSE signatures: updated $($mse.SignatureAge) day(s) ago" }
  } else { ok "MSE not detected (third-party AV may be installed)" }
} else {
  $mp=Get-MpComputerStatus -EA SilentlyContinue
  if($mp){
    if($mp.RealTimeProtectionEnabled){ ok "Defender real-time protection: ON" } else { warn "Defender real-time protection: OFF!" }
    if($mp.AntivirusSignatureAge -gt 3){ warn "Signatures are $($mp.AntivirusSignatureAge) days old" } else { ok "Signatures updated $($mp.AntivirusSignatureAge) day(s) ago" }
  }
  $pref=Get-MpPreference -EA SilentlyContinue
  if($pref.ExclusionPath){ $pref.ExclusionPath | ForEach-Object { warn "Defender exclusion path: $_" } } else { ok "No suspicious exclusion paths" }
  if($pref.ExclusionProcess){ $pref.ExclusionProcess | ForEach-Object { warn "Defender exclusion process: $_" } } else { ok "No suspicious exclusion processes" }
}

hdr "11/12 Hosts File (DNS Hijacking Check)"
Get-Content "C:\Windows\System32\drivers\etc\hosts" |
  Where-Object { $_ -notmatch "^#" -and $_.Trim() -ne "" } |
  ForEach-Object {
    if($_ -match "\d+\.\d+\.\d+\.\d+\s+\S+\.(com|cn|net|org|gov|io)"){ warn "Suspicious redirect: $_" } else { ok $_ }
  }

hdr "12/12 Recent Security Events (last 3 days)"
$evts=@(
  @{Id=4625;Log='Security';Desc='Failed logon (brute force)';Thresh=20},
  @{Id=4720;Log='Security';Desc='User account created';Thresh=0},
  @{Id=4732;Log='Security';Desc='Added to Administrators group';Thresh=0},
  @{Id=1102;Log='Security';Desc='Security log cleared';Thresh=0},
  @{Id=7045;Log='System';  Desc='New service installed';Thresh=0},
  @{Id=4688;Log='Security';Desc='Process creation (audit)';Thresh=50}
)
foreach($e in $evts){
  $cnt=(Get-WinEvent -FilterHashtable @{LogName=$e.Log;Id=$e.Id;StartTime=(Get-Date).AddDays(-3)} -EA SilentlyContinue | Measure-Object).Count
  $line="Event $($e.Id) ($($e.Desc)): $cnt occurrence(s)"
  if($cnt -gt $e.Thresh -and $cnt -gt 0){ warn "$line  <- investigate" } else { ok $line }
}

# ── Win11 extra: Virtualization-Based Security ───────
if($isWin11){
  hdr "13/12 [Win11] VBS / Memory Integrity / Secure Boot"
  $dg=Get-CimInstance -Namespace root\Microsoft\Windows\DeviceGuard -ClassName Win32_DeviceGuard -EA SilentlyContinue
  if($dg){
    if($dg.VirtualizationBasedSecurityStatus -eq 2){ ok "VBS (Virtualization-Based Security): Running" } else { warn "VBS: NOT running — disabled by attacker?" }
    if(2 -in $dg.SecurityServicesRunning){ ok "Memory Integrity (HVCI): Enabled" } else { warn "Memory Integrity (HVCI): Disabled — check if recently changed" }
  }
  $sb=Confirm-SecureBootUEFI -EA SilentlyContinue
  if($sb -eq $true){ ok "Secure Boot: Enabled" } elseif($sb -eq $false){ warn "Secure Boot: DISABLED!" } else { ok "Secure Boot: unable to read (VM?)" }
}

Write-Host ""
Write-Host "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━" -ForegroundColor Cyan
Write-Host " Scan complete [$label]. " -NoNewline
Write-Host "[!!]" -ForegroundColor Red -NoNewline
Write-Host " items need manual review." -ForegroundColor White
Write-Host "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━" -ForegroundColor Cyan

What the script checks:

System info + auto OS detection

Currently logged-on users

Unexpected local admins

Processes in Temp / AppData

Masquerading system processes

Outbound connections (Win7: netstat)

Registry Run key persistence

Scheduled tasks (Win7: schtasks)

WMI event subscriptions

Recent executables (7 days)

Win7: MSE / Win10+: Defender + exclusions

Hosts file DNS hijacking

Win11: VBS / Memory Integrity

Win11: Secure Boot state

Expected output:

Detected OS: Windows 11 (Build 22621) === 5/12 Established Outbound Connections === [OK] chrome (PID 4312) -> 142.250.80.46:443 [OK] Code (PID 9840) -> 20.205.243.166:443 [!!] powershell (PID 2288) -> 103.45.12.7:4444 ← reverse shell? === 8/12 WMI Event Subscriptions === [OK] No WMI EventFilter subscriptions [OK] No WMI EventConsumer subscriptions ... ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ Scan complete [Windows 11]. [!!] items need manual review.

2

🔬 Deep-Dive Commands — After Finding a [!!]

Run these against specific PIDs, file paths, or task names flagged above

Get full command line + parent process by PID

List all network connections for a given PID

SHA256 hash a suspicious file (search on VirusTotal)

Delete a suspicious Run key entry

Remove a malicious scheduled task

Wipe all WMI persistence subscriptions

Show PowerShell command history (find attacker's commands)

Kill a suspicious process

3

💾 Save Report to File

Redirect output to a .txt file for sharing or archiving

Save script as .ps1 then run and capture output

Open the report

4

🔍 How to Interpret Results

[!!] doesn't always mean malware — use this table to decide

High — almost certainly compromised Medium — needs verification Low — likely normal

Finding	Risk	What it means
powershell / cmd outbound to foreign IP	High	Classic reverse shell — almost certain indicator
WMI event subscriptions exist	High	Legitimate software almost never uses WMI subscriptions; APT favourite
svchost.exe NOT in System32	High	Name-spoofing is a textbook malware technique
Event 1102 — log cleared	High	Attacker covering tracks; check what happened just before
Run key value contains -w hidden or -enc	Medium	Verify the program; some legit updaters use hidden windows
Defender exclusion in Temp or AppData	Medium	Malware commonly whitelists its own path
Recent .exe in Temp	Medium	Hash it on VirusTotal; some installers are legitimate
chrome / teams outbound on 443	Normal	Expected browser / app traffic
≤ 20 failed logons in 3 days	Normal	Occasional mistyped passwords

🔑 VirusTotal Hash Check:
1. Run Get-FileHash "path\to\file" -Algorithm SHA256
2. Copy the hash → go to virustotal.com → search
3. 3+ vendors flag it = confirmed malware. 0 flags but suspicious behaviour = possible new variant, still investigate.