Getting Error: PERMISSION DENIED, Error Code: 800A0046 related to Powershell.exe. Thoughts on what I might try to correct this?

John Curham 0 Reputation points
2025-08-28T18:18:07.0166667+00:00

Had a malware attack which has apparently affected the Windows Powershell.exe. Following is what I continue to get with my virus/malware protection software (I have tried multiple softwares):

Threats Blocked           Powershell.exe (get this 5 times each time I scan)

Error messages: Windows Script Host

Script error C:\USERS\PUBLIC\PT2ZQ8.VBS
C:\USERS\PUBLIC\PT2ZQ8.VBS
Line: 44
Char: 1
Error: PERMISSION DENIED
Code: 800A0046
Source: MICROSOFT VBSCRIPT RUNTIME ERROR
Microsoft Security | Microsoft Defender | Other
0 comments No comments
{count} votes

1 answer

Sort by: Most helpful
  1. Michele Ariis 4,505 Reputation points MVP
    2025-08-28T19:03:57.6066667+00:00

    Hi, Isolate your PC (unplug the power). 2) Close wscript.exe, cscript.exe, and suspicious PowerShell processes from Task Manager. 3) Find and remove any VBS remnants: (a) user/system Startup folders; (b) Run/RunOnce keys in HKCU/HKLM; (c) scheduled tasks; (d) WMI subscriptions (root\subscription). 4) Temporarily disable Windows Script Host to block .vbs: create/adjust HKLM\Software\Microsoft\Windows Script Host\Settings → Enabled=0. 5) Delete the malicious file C:\Users\Public\PT2ZQ8.vbs (and clones in %Public%, %TEMP%). 6) Repair Windows: sfc /scannow then DISM /Online /Cleanup-Image /RestoreHealth. 7) Perform a Microsoft Defender Offline scan. 8) Harden: Enable ASR rules in Defender (block suspicious scripts, Office children, etc.), consider AppLocker/WDAC to prohibit scripts from user-writable locations, and set PowerShell to AllSigned. 9) If it returns, use Sysinternals Autoruns (Everything tab) to disable/remove residual startups; if it persists, consider an in-place repair or clean reinstall. Note: PowerShell is almost certainly not "infected," but simply launched by the VBS; eliminating the persistence will stop the warnings.

    0 comments No comments

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.