C:\\WINDOWS\System32\syncappvpublishingserver.vbs

The scheduled task and the script command that point to https://ultahost.gl indicate a malicious persistence mechanism that keeps recreating itself. Removing only the visible scheduled task is not enough; all persistence points that launch wscript.exe or PowerShell with that URL must be removed.

Steps to clean it up:

1. Remove malicious Run entries in the registry
   1. Open PowerShell as Administrator.
   2. List Run entries:

            reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Run
            reg query HKLM\Software\Microsoft\Windows\CurrentVersion\Run
            reg query HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run
      

   3. If any value launches wscript.exe, powershell.exe, or references SyncAppvPublishingServer.vbs or ultahost.gl, delete it, for example:

            reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "<value name>" /f
      

2. Find and delete malicious scheduled tasks
   1. Still in elevated PowerShell, list all tasks and their actions:

            Get-ScheduledTask | ForEach-Object {
                foreach ($a in $_.Actions) {
                    "{0} | {1} {2}" -f ("$($_.TaskPath)$($_.TaskName)"), $a.Execute, $a.Arguments
                }
            }
      

   2. Look for any task whose action runs wscript.exe or powershell.exe with SyncAppvPublishingServer.vbs, ultahost.gl, or similar obfuscated arguments.
   3. For each suspicious task (for example UltahostService{GUID}), remove it:

            Unregister-ScheduledTask -TaskName "UltahostService{GUID}" -Confirm:$false
      

      If it is under a custom path, include -TaskPath "\<path>\".
3. Check for WMI-based persistence
   1. In elevated PowerShell, run:

            Get-WmiObject -Namespace root\subscription -Class __EventFilter
            Get-WmiObject -Namespace root\subscription -Class CommandLineEventConsumer
            Get-WmiObject -Namespace root\subscription -Class ActiveScriptEventConsumer
      

   2. If any entry launches wscript.exe, powershell.exe, or contains ultahost.gl, remove it (or have an experienced technician remove those specific WMI objects).
4. Check Startup folders
   1. Open:
      • %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup
      • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
   2. Delete any unknown .vbs, .ps1, .bat, or shortcut that runs wscript.exe/powershell.exe with suspicious URLs.
5. Verify no malicious PowerShell/WSH processes remain
   1. Run:

            Get-CimInstance Win32_Process | Where-Object {$_.Name -like "powershell*" -or $_.Name -like "wscript*"} | Select Name,ProcessId,ParentProcessId,CommandLine
      

   2. Only processes started manually should appear; if any still show ultahost.gl or similar, repeat the checks above.
6. Run a full security scan
   • After cleaning persistence, run a full scan with Microsoft Defender (and optionally an offline scan) to remove any remaining payloads.

Once all registry Run entries, scheduled tasks, WMI consumers, and startup items that reference SyncAppvPublishingServer.vbs or ultahost.gl are removed, the Windows Script Host popup will stop appearing.

References:

• Power shell open by itself and it says: Running the environment check. Please wait... License OK - Microsoft Q&A
• I stupidly ran this powershell prompt - Microsoft Q&A