Disable PowerShell?

[andrewek 28]

Hello all!

The EmsiSoft blog https://blog.emsisoft.com/2017/11/17/fileless-malware-attacks/

informs about fileless Malvare. And that more often in the Windows registry they hit Windows PowerShell and WMI.

It is recommended that you turn off PowerShell.

But I do not understand how to do this? From the above instructions, it is unclear ...

In my computer(Windows 7x64), I do not find the ability to disable this application

Just launch it as a command line!

Please tell us more about the disable PowerShell!

[JeremyNicoll 78]

Whenn you go to the Control Panel screen which lists installed programs - called "Add/remove programs" on XP and "Programs & Features" on later versions of Windows, you should see a list of applications you installed and probably that's all you're used to looking at there.  But as well as that, there should be an entry at the top left that lets you change which Windows features are enabled.  PowerShell isn't in the list of ordinary installed applications, but as it's a Windows feature, it can be turned off using the option at the top left. 

Does that help?  If not maybe you could post a screenshot of what your "Programs & Features" panel looks like?

[andrewek 28]

Hi!

You mean this is it? components of Windows? But there is no PowerShell

[JeremyNicoll 78]

Yes, that's the right place.   If PowerShell isn't listed (I can't read the cyrillic parts of your screenshot), maybe it's not actually been installed?   According to 

https://blogs.technet.microsoft.com/heyscriptingguy/2011/01/07/how-do-i-install-powershell-on-windows-7-and-other-questions/

PowerShell, if you have it, will have shortcuts at  Start / All Programs / Accessories / Windows PowerShell.    Do you have those?

[GT500 854]

PowerShell comes installed by default on Windows 7, Windows 8, Windows 8.1, and Windows 10 (in fact it has superseded the Command Prompt on Windows 10).

In theory it could have already been uninstalled, or the name in the list is in Russian and possibly doesn't translate as expected.

[slopes 3]

How do you uninstall /disable powershell on windows 7?

[slopes 3]

6 hours ago, JeremyNicoll said:

Whenn you go to the Control Panel screen which lists installed programs - called "Add/remove programs" on XP and "Programs & Features" on later versions of Windows, you should see a list of applications you installed and probably that's all you're used to looking at there.  But as well as that, there should be an entry at the top left that lets you change which Windows features are enabled.  PowerShell isn't in the list of ordinary installed applications, but as it's a Windows feature, it can be turned off using the option at the top left. 

Does that help?  If not maybe you could post a screenshot of what your "Programs & Features" panel looks like?

Windows 7 doesn't list it in programs and features or in turn features off or on.I do have it in windows accessories .

[andrewek 28]

5 hours ago, JeremyNicoll said:

Yes, that's the right place.   If PowerShell isn't listed (I can't read the cyrillic parts of your screenshot), maybe it's not actually been installed?   According to 

https://blogs.technet.microsoft.com/heyscriptingguy/2011/01/07/how-do-i-install-powershell-on-windows-7-and-other-questions/

PowerShell, if you have it, will have shortcuts at  Start / All Programs / Accessories / Windows PowerShell.    Do you have those?

Yes, in the list of programs, as you indicated, have the PowerShell.

[JeremyNicoll 78]

Hmm.  A bit more googling looking for explicit instructions on how to remove Powershell from win 7 suggests it's not really possible.  Some posts suggest things like removing registry keys (which I suppose might make Windows think it's not there, but it still will be).   I've also seen suggestions that uninstalling "windows management framework 5.0" might remove PowerShell as well.  But I have no idea if that is true nor whether it's a good idea.

 

I see that @Umbra has said (in comments on the oroginal blog entry) that there's W7 advice on the net.  Perhaps he could say which advice is the right advice... and if there's disadvantages to following it?

[andrewek 28]

Hi!

But I absolutely do not use PowerShell, I never run. Maybe there is no danger then?

Obviously, there is no way to remove this preinstalled program from the computer!

[slopes 3]

1 hour ago, andrey said:

Hi!

But I absolutely do not use PowerShell, I never run. Maybe there is no danger then?

Obviously, there is no way to remove this preinstalled program from the computer!

From what I understand it is still vulnerable if you don't run it.

[andrewek 28]

Hi!

It is about this (vulnerability) and is reported in the blog Emsisoft!

[GT500 854]

There doesn't appear to be a way to uninstall PowerShell in Windows 7. You might be able to create an Application Rule in Emsisoft Anti-Malware to block PowerShell from running though.

On my Windows 7 computer it looks like PowerShell can run out of the following locations:

• C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
• C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe
• C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
• C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe

[slopes 3]

1 hour ago, GT500 said:

There doesn't appear to be a way to uninstall PowerShell in Windows 7. You might be able to create an Application Rule in Emsisoft Anti-Malware to block PowerShell from running though.

On my Windows 7 computer it looks like PowerShell can run out of the following locations:

• C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
• C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe
• C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
• C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe

Thanks GT500, I blocked them all.

I have read that windows 7 needs powershell for other functions?

I'll see what happens

Thanks again!

[Peter2150 45]

Powershell is a tough bird.  I've got the same four powershell exe's blocked, but that won't stop it.   Won't break anything for most users,  but  won't block it.   There is also a DLL  system.managament.autmation.dll  that  can fire off Powershell.   Not sure extactly w here in windows it, I've got it blocked with wildcards. 

I've done a lot homework on powershell malware and there are two bottom lines.

 

1.  If some can get the right script on your computer and it runs, it's game over.  They own you.

2.  The good news, is all of these infections were delivered by  email, so if you good email control your are safe

[Umbra 30]

system.management.automation.dll  is the one to block if you worry about powershell-based exploits. 

[slopes 3]

1 hour ago, Umbra said:

system.management.automation.dll  is the one to block if you worry about powershell-based exploits. 

How is this entered into a rule? I found it in C:\Windows\winsxs\msil_system.management.automation.........

Edit....Entered entire address emsisoft says file doesn't exist

 

Thanks

[Umbra 30]

You have to select "all files" in the search window.

[slopes 3]

55 minutes ago, Umbra said:

You have to select "all files" in the search window.

Yes! that worked 

thank you Umbra

[Insert Real Name 1]

Does one need to disable Powershell completely? And is this even desirable or possible on Windows versions greater than 7? On my Windows 7 machine, I started a Powershell console w/administrative privileges and ran

Set-Execution-Policy -Scope LocalMachine Restricted

which disables running PowerShell scripts execution in any context. Individual Powershell commands are still allowed, of course, so Powershell-powered malware hasn't been entirely neutered, but this is a significant protection I think.

[Umbra 30]

@Insert Real Name Yes, this is a start, but if you don't need Powershell at all, better disable it "completely".

[Amadei 0]

How much time did it take?

[Peter2150 45]

On 11/27/2017 at 6:57 PM, Umbra said:

@Insert Real Name Yes, this is a start, but if you don't need Powershell at all, better disable it "completely".

Hi Umbra

On win 7 x64 Pro   exactly how do you completely disable Powershell

[Umbra 30]

@Peter2150

1- by restricting users to use it  via Group policy 

https://community.spiceworks.com/topic/1183987-disabling-powershell-with-group-policy

2- via SRP, blocking:

• C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
• C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe
• C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
• C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe
• system.management.automation.dll

3- by uninstalling it

windows/forum/windows_7-performance/how-to-uninstall-powershell-windows-7/c7077177-294d-4aed-8307-a1a554a56ae5?auth=1

 

i usually just do step 2, good enough for me.

 

[Peter2150 45]

Thanks Umbra.   I've also done step 2,  and I suspect your right that is good enough.

[GT500 854]

On 12/25/2017 at 6:53 AM, Amadei said:

How much time did it take?

Most of the methods for disabling PowerShell mentioned here shouldn't take more than 5-10 minutes.

[Umbra 30]

Yes because Powershell isn't dangerous by itself, and is needed sometimes by the system reason why you can't remove it (only the old version can); not saying on Win10, it will replace cmd very soon.

So since the old v2 is vulnerable and often used as an attack vector, disabling its execution is enough.

[biodegradable 1]

thanks and Umbra and Peter,i delete it also although i didnt know what is anyway xd

[slopes 3]

On 12/25/2017 at 7:07 PM, Umbra said:

@Peter2150

1- by restricting users to use it  via Group policy 

https://community.spiceworks.com/topic/1183987-disabling-powershell-with-group-policy

2- via SRP, blocking:

• C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
• C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe
• C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
• C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe
• system.management.automation.dll

3- by uninstalling it

windows/forum/windows_7-performance/how-to-uninstall-powershell-windows-7/c7077177-294d-4aed-8307-a1a554a56ae5?auth=1

 

i usually just do step 2, good enough for me.

 

Just curious why is step 2 considered a srp? Because a password is required to change it?

[JeremyNicoll 78]

> Just curious why is step 2 considered a srp? Because a password is required to change it?

I think SRP is 'Software Restriction Policy' - as described eg at: https://technet.microsoft.com/en-gb/library/bb457006.aspx  - is that what you think it means?

[slopes 3]

38 minutes ago, JeremyNicoll said:

> Just curious why is step 2 considered a srp? Because a password is required to change it?

I think SRP is 'Software Restriction Policy' - as described eg at: https://technet.microsoft.com/en-gb/library/bb457006.aspx  - is that what you think it means?

I thought it meant Secure password based authentication, must of been a typo in my google search,  your def makes much more sense.

Thanks again for answering my stupid questions Jeremy

[Umbra 30]

5 hours ago, JeremyNicoll said:

> Just curious why is step 2 considered a srp? Because a password is required to change it?

I think SRP is 'Software Restriction Policy' - as described eg at: https://technet.microsoft.com/en-gb/library/bb457006.aspx  - is that what you think it means?

SRP is indeed Software Restriction Policy, like Windows' Applocker (available in pro version) and some other 3rd party softs.

Step 2 can be done with any default-deny type of softs (those allowing you to select a executable and block it from running) , EAM can block them too. 

[andrewek 28]

Hello All!

Last year, the issue of Filelles malware was discussed, and disabling Windows PowerShell was recommended as one of the protection methods.

https://blog.emsisoft.com/en/29070/fileless-malware-attacks/

Obviously, PowerShell itself is not dangerous. Dangerous scripts that she can use.

 

And as it is today, when Windows 10 is actively coming and using PowerShell, it is obvious that you will ever have to (I read that it can even replace cmd>) - what should you do today, do you need to disable and / or block PowerShell (for example, through settings Emsisoft Behavioral Blocker)?

 

 

[GT500 854]

PowerShell has a built-in permissions system these days that automatically prevents execution of downloaded scripts. This of course does not prevent an application (or a batch file) from executing PowerShell commands from the command line, so it does not negate all of the dangers of PowerShell, however I don't think this is quite as common as it was when we made that recommendation and it certainly is better understood and detected now than it was back then.

[andrewek 28]

Hello!

Thank you!

Do you think it is possible to remove from the settings of the EAM Behavior Blocker what has been proposed and how?

[JeremyNicoll 78]

I think most users would want to know if any system process has been stopped (especially if they did not know how/why), so if it is possible to suppress the information it'll need to be something that individual users do, not something central that affects us all.

[andrewek 28]

Hi!

I do not quite understand you: Are you against publishing such screenshots? But 2 years ago all these actions are already described in detail!

[JeremyNicoll 78]

No, the screenshots are fine.    You asked " ... to remove from the settings of the EAM Behavior Blocker what has been proposed and how" ...

I think that if that is possible, it should be something that Emsi tell you how to do, but they should not change BB so that other people don't see the BB messages.   Other people, and certainly me, will want to know if powershell has been disabled IF IT WASN'T DONE BY THEM.

 

[andrewek 28]

But it’s clear from the whole topic that these settings changes are made by me, the user.

These are not standard EAM settings!

 

My English probably doesn’t allow me to fully understand the meaning)

Or did I understand correctly?

[Amigo-A 136]

@andrey

Есть немало шифровальщиков, которые используют Windows PowerShell для атаки и успешно осуществляют её в массовом порядке. В том числе до сих пор живо целое их поколение, которое или так и называется PowerShell Locker Ransomware или приобретает новые имена (типа этого) и ЭТО до сих периодические распространяется, когда у криптонариков набрутенные баксы перестают им петь романсы. 
Если бы этой функции не было в составе Windows, то им пришлось бы внедрять что-то подобное, чтобы осуществить эту атаку, вот тут поведенческий анализ и дал бы им жару. 
Если вы сами никогда не пользуетесь Windows PowerShell то отключите эту горе-фичу от греха подальше. 

[JeremyNicoll 78]

I understand that you (somehow) disabled Powershell, and you know you did that.

Earlier you asked for a way for BB not to tell you (that Powershell is disabled).   If Emsisoft change EAM so that no user sees these messages then that is dangerous for people whose Powershell has been tampered with.   I don't care if there's a way for just you not to see the messages, but I don't think other EAM users should lose the information.

[andrewek 28]

Ok, of course, now I understand)

[GT500 854]

20 hours ago, andrey said:

Do you think it is possible to remove from the settings of the EAM Behavior Blocker what has been proposed and how?

Edit the rules and change them to "Monitored".

Although, feel free to follow Amigo-A's advise, and keep PowerShell blocked if you'd like.

[andrewek 28]

Hello!

Since I do not use PowerShell, I will disable it.