I've been working today on a little project when suddenly my modules stopped working. It was weird because I have not touched anything that could cause it.
I've been working today on a little project when suddenly my modules stopped working. It was weird because I have not touched anything that could cause it.
Import-Module : The script 'PSSharedGoods.psm1′ cannot be run because the following modules that are specified by the „#requires” statements of the script
are missing: PSWriteColor.
At C:\Support\GitHub\PSWinReporting\Examples\RunMe-SearchEvents.ps1:2 char:1
+ Import-Module PSWinReporting -Force
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : ResourceUnavailable: (PSSharedGoods.psm1:String) [Import-Module], ScriptRequiresException
+ FullyQualifiedErrorId : ScriptRequiresMissingModules,Microsoft.PowerShell.Commands.ImportModuleCommand
A message was a bit cryptic mentioning that my PSWriteColor module is required but not available. I've decided to try and load PSWriteColor manually using Import-Module command.
Import-Module PSWriteColor
That's where I got this little message at the bottom that made me wonder what I've done with my precious module that it is now a virus.
Import-Module : The module manifest 'C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\PSWriteColor\PSWriteColor.psd1′ could not be processed because it i
s not a valid Windows PowerShell restricted language file. Remove the elements that are not permitted by the restricted language:
At C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\PSWriteColor\PSWriteColor.psd1:1 char:1
+ #
+ ~
This script contains malicious content and has been blocked by your antivirus software.
At line:1 char:1
+ Import-Module PSWriteColor
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : ResourceUnavailable: (C:\WINDOWS\syst…WriteColor.psd1:String) [Import-Module], MissingMemberException
+ FullyQualifiedErrorId : Modules_InvalidManifest,Microsoft.PowerShell.Commands.ImportModuleCommand
As I don't use any antivirus software other than the built-in Windows Defender I assumed that it must have updated its definitions at some point today and none of my PowerShell modules will be working correctly. A quick check into definitions, confirms that the update has kicked in around 11:14 but a day before and I've already worked with that module during that time.
If we check what Windows Defender has been doing behind scenes we will find out that AMSI (Anti-Malware Scan Interface) was responsible for making my module rogue.
I've decided that updating virus definitions again should solve this, eventually I was prepared to totally disable Windows Defender for the time being.
Fortunately, new virus definition kicked in after few seconds everything is now working correctly. Must have been some weird hiccup on Windows Defender part. It didn't require restart of PowerShell session either.
This post was last modified on 7 czerwca, 2025 11:36
Ever wondered how to run network diagnostics like Ping, Traceroute, or DNS queries from probes…
Are you tired of manually running network diagnostics like Ping, Traceroute, or DNS queries? The…
Discover new features in the PSWriteHTML PowerShell module – including New-HTMLInfoCard, improved layout controls with…
Security Identifier (SID) History is a useful mechanism in Active Directory (AD) migrations. It allows…
Today, I made the decision to upgrade my test environment and update the version of…
Have you ever looked at your Active Directory and wondered, "Why do I still have…
