To remove PowerShell/Falsip.A Trojan Downloader, follow these steps: STEP 1: Print out instructions before we begin. STEP 2: Use Rkill to terminate suspicious programs.

Is execution of powershell scripts enabled in AD? I think it's off by default. Also, is the script signed? I believe the default doesn't allow unsigned scripts to run.