OneChecker Scheduled Task: Remove Hidden PowerShell Malware

A OneChecker scheduled task is not required by Windows. If you did not create it and its Action launches cmd.exe or a hidden PowerShell window to run a random .ps1 file, treat it as suspicious. Disable the task without running it, record the Action and Trigger, remove the associated script or unwanted program, then scan the whole PC for the component that created the task.

Deleting only the task may stop the hourly CMD or PowerShell flash, but it does not prove the computer is clean. Public OneChecker reports show the task pointing to randomized scripts under paths such as %LOCALAPPDATA%\reserve\red\{random}\{random}.ps1. A downloader, bundled app, browser policy, extension, service, or second task can remain after the visible entry is gone.¹

Is the OneChecker task malware?

The name alone is not a malware verdict because any application or user can create a scheduled task with an arbitrary label. The Action is the deciding evidence. Windows does not need a root-level task named OneChecker to run a hidden, policy-bypassing PowerShell script from a random user folder.

The suspicious pattern is the relationship: a recurring trigger, cmd.exe, hidden PowerShell, execution-policy bypass, and a script in a random or unrelated folder. The Windows binaries can be genuine while the command they launch is malicious. This is a common reason script-based malware can look harmless when someone checks only the signer of cmd.exe or powershell.exe.

Why CMD or PowerShell opens every hour

Task Scheduler can repeat an Action at a fixed interval. A task may briefly steal focus or minimize a full-screen game when it starts cmd.exe and PowerShell, even when the command tries to use a minimized or hidden window. The flash is a symptom of the launcher; it does not reveal what the script did.

Do not paste the script into PowerShell, run the task for testing, or upload a private script that contains personal paths or tokens. Record the file path and timestamps. If investigation is needed, let a security tool quarantine the file or have an administrator examine it as text in an isolated environment.

Do not confuse OneChecker with DmClientOnScenarioDownload

Some users notice DmClientOnScenarioDownload near the same time as the popup. That is a separate Windows feedback task when it appears under \Microsoft\Windows\Feedback\Siuf\ and launches %windir%\system32\dmclient.exe. A public Microsoft Q&A case about OneChecker distinguished that Microsoft task from the suspicious root-level OneChecker entry.¹

Verify the full Task Path, Action, file location, and Microsoft digital signature. Do not delete a legitimate Microsoft task merely because its Last Run Time matches the unwanted popup. Conversely, a Windows-looking executable name does not make OneChecker safe when the rest of its command launches an unrelated script.

Inspect OneChecker without running it

1. Open Task Scheduler. Press Win + R, enter taskschd.msc, and open Task Scheduler Library.
2. Select OneChecker, but do not run it. Open Properties and record the Task Path, Author, creation time, user account, hidden setting, and whether it runs with highest privileges.
3. Check Triggers. Note logon, startup, hourly repetition, and the next run time.
4. Check Actions. Copy the Program/script, arguments, and Start in path. Photograph or export the properties if you may need incident evidence.
5. Review History. Compare the first and last run times with the day the popup, redirect, unknown extension, or unwanted program began.

Windows also provides schtasks for read-only task inspection. Microsoft documents that /query displays scheduled tasks and that /xml exposes the task definition.² These commands do not start the Action:

schtasks /query /tn "\OneChecker" /fo LIST /v
schtasks /query /tn "\OneChecker" /xml

If the exact task path differs, copy it from Task Scheduler and use that full path after /tn. An administrator account may be required to inspect or change tasks created for another user or for SYSTEM.

Disable and remove OneChecker safely

1. Disconnect from sensitive activity. If the popup is recurring or the script already ran, stop banking, password changes, and other sensitive logins on that PC until cleanup is complete.
2. Disable the task first. Right-click OneChecker and choose Disable. Wait past its normal repeat interval when practical. If the popup continues, another trigger is involved.
3. Preserve the definition. In Task Scheduler, use Export to save the XML before deletion. Store it only as evidence; do not import it on another computer.
4. Delete the disabled task. After its Action and Trigger are recorded, right-click OneChecker and choose Delete. Avoid manual TaskCache registry deletion; an inconsistent task database is harder to repair.
5. Remove the target script safely. Navigate to the recorded folder without opening the script. Quarantine it with your security tool. If it sits under an unfamiliar installed-program folder, uninstall that program through Settings → Apps → Installed apps, then check whether the folder remains.
6. Look for sibling persistence. Sort Task Scheduler Library by creation time and inspect tasks created around OneChecker. Check Startup apps, services, Run keys, WMI subscriptions, and Defender exclusions for changes you did not authorize.
7. Review browser changes. Remove unknown extensions, notification permissions, startup pages, and search providers. On a personal PC, investigate unexpected entries in chrome://policy/ or edge://policy/. If an extension returns, follow the recurring extension cleanup guide.
8. Check the hosts file and proxy. Unexpected redirects after OneChecker removal can come from browser policy, proxy settings, DNS changes, or unauthorized lines in C:\Windows\System32\drivers\etc\hosts.

For a broader persistence review, use the Windows security audit after malware. If network alerts identify PowerShell as the visible process, the PowerShell outbound-connection triage explains how to work backward to the task, script, or parent application.

Scan for the component that created OneChecker

Removing the task stops one launch point. It does not remove a loader, service, browser companion, startup entry, Defender exclusion, or bundled module that can recreate the task. Run a full Gridinsoft Anti-Malware scan after the manual checks to look for related files, scheduled tasks, startup entries, browser changes, and other persistence. Remove confirmed detections, reboot, and scan again if the popup or task returns.

If ordinary scans stay clean but OneChecker returns after reboot, use Microsoft Defender Offline or an equivalent trusted offline scan. Microsoft explains that the Offline scan restarts into the Windows Recovery Environment so persistent malware has a harder time hiding while Windows is running.³

When to change passwords or reinstall Windows

A suspicious scheduled task proves unauthorized persistence, not necessarily password theft. Treat account risk as higher when the script ran and you also saw browser hijacking, unknown extensions, stolen-session alerts, remote-access tools, new logins, or security exclusions.

• From a clean device, change passwords for email, banking, password manager, Microsoft/Google, and other important accounts.
• Use each account’s security page to sign out other sessions and remove unknown devices or recovery methods.
• Reinstall Windows from trusted media when the task keeps returning, security settings cannot be restored, remote access is suspected, or you cannot establish what executed.
• Restore documents from a backup made before the infection when possible; do not restore unknown scripts, installers, cracks, or browser profiles wholesale.

FAQ

References

1. Microsoft Q&A. “Why does command prompt randomly open and close and how to stop it from minimizing my window?” Microsoft Learn community, April 2025, accessed August 27, 2026. learn.microsoft.com.
2. Microsoft. “schtasks commands.” Microsoft Learn, updated February 3, 2023, accessed August 27, 2026. learn.microsoft.com.
3. Microsoft. “Troubleshoot problems with detecting and removing malware.” Microsoft Support, accessed August 27, 2026. support.microsoft.com.