Recovering Windows tools after malware blocks command access

When malware disables Command Prompt and PowerShell, it may be trying to stop security scans, prevent removal commands, or keep you from changing system settings. The block can appear as a message saying that the administrator has disabled the tool, or the window may open and close immediately.

Treat the computer as potentially compromised until you verify otherwise. Disconnect from Wi-Fi or unplug the Ethernet cable, especially if the device contains banking, work, or personal information. On an Australian home connection, including NBN services, this step can limit communication with a remote attacker while you investigate.

Check whether the block affects one account

Sign in with another trusted Windows account if one is available. A restriction that affects only your normal profile may come from a per-user policy, a damaged profile, or malware stored in that account’s startup locations.

Press Ctrl+Shift+Esc to open Task Manager, then choose Run new task from the menu. Try launching explorer.exe, mmc.exe, or msconfig. If Task Manager itself is blocked, use the Windows Security screen with Ctrl+Alt+Delete and select the power icon while holding Shift to restart into recovery options.

Do not repeatedly guess administrator passwords or download random “CMD unlocker” utilities. Many such tools are bundled with adware or remote-access malware and can make the infection harder to remove.

Use Safe Mode for a cleaner workspace

Safe Mode loads Windows with a limited set of drivers and startup programs. From the recovery screen, select Troubleshoot, Advanced options, Startup Settings, and Restart. Choose Safe Mode, or Safe Mode with Networking only when an essential security download requires internet access.

In Safe Mode, review recently installed applications under Settings > Apps > Installed apps. Remove programs you do not recognise, especially ones installed shortly before the command-line restriction appeared. Also inspect Task Manager’s Startup apps and disable suspicious entries, but avoid deleting files until they have been scanned.

If the malicious program blocks normal recovery, hold Shift while choosing Restart from the Start menu. This method often works even when the desktop behaves oddly after a suspicious attachment or cracked application has been opened.

Scan from outside the infected session

Microsoft Defender Offline can scan before the usual Windows environment fully starts. Open Windows Security if possible, go to Virus & threat protection, choose Scan options, and select Microsoft Defender Offline scan. Save open documents first because the computer will restart.

If Windows Security will not open, create trusted installation or rescue media on a clean computer. Use a USB drive from a reputable security vendor, boot the affected PC from it, and follow the vendor’s malware-scanning instructions. Never create rescue media on the infected machine.

A full scan is important for trojans, spyware, ransomware loaders, and browser hijackers. A quick scan may miss scheduled tasks or files hidden in user folders. Australian users should be particularly cautious if the device is used for online banking, tax records, or myGov access.

Compare recovery paths before making changes

The best method depends on whether the restriction is caused by malware, an administrator policy, or damaged Windows components. The options below help identify a suitable route without immediately editing sensitive system files.

Recovery path	Best use	Main limitation
Safe Mode	Removing startup malware and suspicious apps	Some threats still load
Defender Offline	Scanning before Windows starts	Requires a restart and saved work
Recovery Environment	Accessing repair and restore features	May not remove personal-data-stealing malware
New administrator account	Testing whether the block is profile-specific	Does not clean the original infection
System Reset	Severe or persistent compromise	Apps and possibly personal files may be removed

System Restore can help when the problem began after a recent installation, provided restore points were created before the infection. It does not guarantee removal of modern malware, so run a reputable scan afterwards.

A Windows reset is more disruptive, but it may be safer than spending hours trying to repair a heavily compromised system. Choose the option that removes applications and settings, and back up only personal files that have been scanned first.

Repair policies only after scanning

Command Prompt and PowerShell can be disabled through Group Policy or Registry settings. Common policy locations include settings associated with DisableCMD, but changing them while malware is active can give the attacker more freedom and may damage Windows configuration.

If a security scan finds no active threat and the computer belongs to you, check Local Group Policy by launching gpedit.msc from Task Manager’s Run new task. Under User Configuration, review administrative templates related to system access and command-line tools. Set an unintended restriction to Not configured, then restart.

Windows Home editions may not include the Group Policy Editor. Registry changes are possible, but export the relevant key first and create a restore point. A wrong deletion or value can create new startup problems, so professional assistance is sensible for a work computer or a machine containing sensitive records.

Rebuild access with trusted Windows tools

Windows Terminal, Command Prompt, and PowerShell are separate entry points, but malware can block all of them through policy, image tampering, or process monitoring. If one tool works, use it only for recognised Microsoft repair commands and avoid scripts copied from forums or social media.

From an elevated trusted shell, System File Checker and Deployment Image Servicing and Management can repair damaged Windows components. Typical commands are sfc /scannow and DISM /Online /Cleanup-Image /RestoreHealth. Run them after malware removal, because repair tools do not substitute for an antivirus investigation.

If PowerShell is available only under another account, do not use execution-policy bypasses to force unknown scripts. That approach can conceal malicious activity. Instead, use signed Microsoft utilities, confirm every command, and keep a written record of changes.

Protect accounts and recover safely

A blocked command shell can be a symptom of credential theft rather than the only problem. From a clean device, change passwords for email, banking, cloud storage, and social accounts. Enable multifactor authentication and sign out other sessions where each service allows it.

If suspicious emails were involved, review this email scam removal guide for related indicators and cleanup considerations. Australians can also report scams to Scamwatch and check advice from the Australian Cyber Security Centre, particularly when money, identity documents, or business accounts may be exposed.

Keep backups disconnected or versioned so ransomware cannot encrypt every copy. Apply Windows updates, update browsers and extensions, remove pirated software, and use a standard user account for everyday work. Further practical security tips can help reduce the chance that a future attachment or fake update disables essential Windows tools again.

Practical steps for a safer recovery

• Disconnect the affected PC from Wi-Fi or Ethernet before investigating.
• Record error messages, recently installed programs, and suspicious file names.
• Run Microsoft Defender Offline or a trusted rescue scan before changing policies.
• Back up only personal files that have been checked for malware.
• Change important passwords from a separate, clean device.
• Reset Windows or seek qualified help when scans show a persistent infection, ransomware, or credential theft.