Fix power shell popup on start up Windows 11

Use Microsoft Sysinternals Autoruns to locate and disable the hidden startup entry launching PowerShell, because it examines substantially more autostart locations than Task Manager, the Startup folder, Services, or the standard Task Scheduler view.^1^

Find the PowerShell launcher

1. Download Autoruns from Microsoft’s Sysinternals page.
2. Extract the ZIP, right-click Autoruns64.exe, and select Run as administrator.
3. Wait until the status bar shows Ready.
4. Select Options:
   • Enable Hide Microsoft Entries.
   • Enable Verify Code Signatures.
5. Press Ctrl+F and search individually for:
   • powershell
   • pwsh
   • .ps1
   • cmd.exe
   • wscript
   • cscript
6. Examine matches under Logon, Scheduled Tasks, Services, and WMI. Autoruns covers Run/RunOnce keys, startup folders, services, scheduled tasks, Winlogon entries, and other autostart mechanisms.^1^
7. For a suspicious entry:
   • Right-click it and select Properties to inspect its executable path and command.
   • Select Jump to Entry to see where it is configured.
   • Clear its checkbox to disable it; do not delete it yet.
8. Restart Windows. If the popup stops, leave that entry disabled and uninstall the associated application through Settings → Apps → Installed apps, if applicable.

Entries are especially suspicious when they execute PowerShell with an unknown script, an unexpected web address, ExecutionPolicy Bypass, or files in unusual temporary/profile locations. Do not disable an entry solely because its name is unfamiliar; first inspect its publisher, path, and command.

Identify the parent process if Autoruns is inconclusive

While the unwanted PowerShell window is open, open a separate PowerShell window normally and run:

Get-CimInstance Win32_Process |
  Where-Object Name -Like 'powershell*' |
  Select-Object Name, ProcessId, ParentProcessId, CommandLine

Get-CimInstance Win32_Process |
  Select-Object Name, ProcessId, ParentProcessId, CommandLine |
  Sort-Object ProcessId

Match the unwanted PowerShell process’s ParentProcessId to the second list. The parent’s name and command line can identify the application or startup component invoking it. A similar Windows 11 case used this process-parent check to expose a concealed scheduled task that the normal Task Scheduler inspection had missed.^2^

Correct way to open the Startup folders

shell:startup is a Run/File Explorer shell command, not a Command Prompt or PowerShell command. Press Windows+R, then enter:

• shell:startup — current user
• shell:common startup — all users

The corresponding folders are:

• %userprofile%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
• %ProgramData%\Microsoft\Windows\Start Menu\Programs\Startup

Microsoft documents both locations and notes that shortcuts can be removed from them to stop startup behavior.^3^

If shell:startup opens an empty Expr1ssVPN folder, do not delete that folder merely because of its name. Check both explicit paths above and use Autoruns to inspect the actual configuration pointing there.

If the entry looks malicious

Save open work, then run:

Windows Security → Virus & threat protection → Scan options → Microsoft Defender Antivirus (offline scan) → Scan now

The computer restarts and scans before normal Windows loads, making persistent malware more difficult to hide. Results appear under Windows Security → Protection history.^4^

Do not manually delete registry values or scheduled tasks until the responsible entry has been identified. Disabling it in Autoruns first is reversible and confirms whether it actually causes the popup.

References

1. Autoruns v14.3
2. Power shell open by itself and it says: Running the environment check. Please wait... License OK - Microsoft Q&A
3. Configure Startup applications in Windows | Microsoft Support
4. Virus and Threat Protection in the Windows Security App | Microsoft Support