Weird PowerShell Executable

Topic

New Reply

[RetiredGeek]

Hey Y’all,

I ran into a problem that had me stumped for a while and I’m still don’t know how it happened in the first place.

I tried to start the command line version of Windows PowerShell (PowerShell.exe) from the search menu on Start (Note I’m using Win 10 21H1 and Classic Shell)

Clicking on that entry resulted in…

Now I know that this shouldn’t have happened because I could start it from my taskbar menu system in Administrator mode w/o problem, but I wanted to start it in user mode to test some code as a user when I got the bogus message.
I then tried to start it by going to the file in File Explorer: C:Windows\System32\WindowsPowerShellv\1.0\PowerShell.exe and low and behold it started right up loading my profile and everything!

Now this was starting to really bug me so I tried the search again but this time I used the right-click menu to look at it’s properties and this is what I found.

Yes a zero length PowerShell.exe in C:Windows\System32 and this is the only one that showed up in the search, note it does NOT have the PowerShell Icon. Believe me I have absolutely no idea how this file was created and as you can see it was created back in September! I checked my test rig (same setup) and it worked normally. I also tested my laptop and it worked normally also.

Anyone have any Idea how this happened?  However, I did just find this explanation but it doesn’t explain why it happened on only one of three machines.

Inquiring minds want to know…LOL!

May the Forces of good computing be with you!

RG

PowerShell & VBA Rule!
Computer Specs

• This topic was modified 3 years, 5 months ago by RetiredGeek.
• This topic was modified 3 years, 4 months ago by RetiredGeek.

Reply | Quote

Replies

RG -Your post has fallen foul of the forum software glitch that removes backslashes from filepaths. 🙁

At a guess, the zero-byte powershell.exe file in %SystemRoot%\System32 is just a placeholder left over from a Windows Update error after a temporary copy of powershell.exe was created (and used as part of the updating process).

Unfortunately, confirming an update error will take some work as it will involve first generating a WindowsUpdate.log file from the Event Trace (.etl) files. This is very easy to do but the amount of information that ends up in a folder on your desktop is huge!

If this info doesn’t make it readable for you to work out what happened (around the time the Date modified of the placeholder file changed) then possibly analyse it with the SetupDiag tool.

More info can be found here:

Windows Update log files

Get-WindowsUpdateLog

SetupDiag (I’ve never used this myself.)

Hope this helps…

Reply | Quote

Did I miss any fixes?

1 user thanked author for this post.

RetiredGeek

Reply | Quote