Powershell opened up, switched to administrator mode and ran scripts all without me touching my computer. How worried should I be?

Question

I'm on a laptop running Window 8.1 connected to the internet running Kaspersky. I am the sole user and administrator of this laptop. While going about my usual work, I paused for a moment (hands off both keyboard and mouse) during which time a powershell windowed opened all by itself and started flashing. With each flash, the window switched between Administrator and normal mode until after about three seconds and stayed steady in Administrator mode. It paused for about another half second and then ran something so fast I couldn't see what it was and then a second powershell window opened up in front of it and ran something else but this time all the output was in red text. I've tried to google around and find out what might have caused this but I haven't been able to find anything of value so I'm hoping that somebody in this community might have some awareness of what this is, whether or not I should be concerned and what I should do about it.

In short: Powershell opened by itself on windows 8.1, changed itself to Administrator mode and ran two scripts all without me touching anything. Should I be worried or terrified?

Answer 1

While I'd recommend following ekaj's suggestion and trawling your logs to be sure, it sounds very suspicious to me.

If you have allowed automated updates, it is possible that this was part of an update script...but usually updates present quite formalised user information.

Safest bet is to assume the worst - and wipe it and rebuild. A Powershell running as admin could have done anything.

We have a range of questions here on what to do once a machine has been compromised...the canonical answer is, however, to do a complete wipe, and either rebuild from a known clean backup or from installation media.

Answer 2

I know I'm super late to this party, but this question came up for me while I was searching Sec.SE in relation to another situation that I'm dealing with at work. I also think I could provide something useful that hadn't been touched upon yet. Although I'd agree with Rory Alsop, I'd also like to add something that both backs his answer up and gives you another piece of advice beyond wiping your computer; which I fully recommend that you do (hopefully by now you've already DONE this). Lastly, this is for anyone else who comes upon this question and can get perhaps a comprehensive view between both of our answers.

On to my answer... (and this only adds to the original accepted answer; always check logs first and do some research)

For me, I'd be equally as worried that whatever was running was able to elevate itself to Admin in PowerShell. This could (it isn't definite) indicate that whatever was running grabbed your credentials either from the cached credentials that Windows stores on the local disk, or from some keylogger that may have remained hidden, and then used them to elevate itself and run a myriad of things. There are a number of ways your admin password (and other passwords) could have become compromised if indeed that did happen. That leads me down the path of being paranoid and assuming the worst as has already been stated, which means that your passwords were stolen (let's say WERE STOLEN for the context of this answer) and now you have that as a problem. Here are two things to do, in addition to wiping your computer and starting over from scratch.

1. Change your password(s) used on this computer no matter what they were for. You never know what was compromised if a keylogger or malicious piece of software sat on your system without you knowing it.
2. Create a regular user account that you use for everyday use and an administrative user account that you only use when something needs to run with permission from an elevated account; turn UAC (User Account Control) on to bolster this tactic and run things as administrator when needed. That way if your regular account gets compromised, the admin account won't automatically be compromised and would-be hackers would have a harder time trying to perform a successful attack.
3. Use a VM: Create a virtual machine that you do sensitive, admin privileged-type of work on. Still use tactic #2 above when using this VM and log in with a regular user and only use admin credentials as needed by using "Run as administrator". If the VM is compromised, simply delete it and create a new one from scratch. While VM escape (the act of escaping the VM back into the host machine) isn't impossible, it's much more difficult than most people realize. Utilize the various snapshot tools integrated into most hypervisors of today to really make this tactic efficient, then you won't have to wipe your main machine each time something like this happens.