When Malware Disables Keyboard and Mouse Input

Malware that disables keyboard and mouse input in certain programs can make a Windows or Mac look frozen while other windows still respond. Signs include a blank field, an invisible full-screen layer, focus returning to the same window, or an app that closes during interaction. These clues suggest an injected hook, malicious overlay, altered accessibility setting, or ransomware screen rather than failed hardware.

First separate a program-specific lock from a total input failure. If clicking works in Settings but not in one browser or game, suspect that process. If neither device responds anywhere, check Safe Mode, drivers, cables, and hardware. A keyboard working after a reboot does not clear the system, since malware can intercept input after startup.

Disconnect Ethernet and turn off Wi-Fi, then avoid entering passwords or payment details. Photograph the blocked screen before restarting if safe. If filenames are changing or encryption messages appear, isolate the device and seek incident advice. Use a separate phone or computer for account changes, and do not plug unknown USB media into either device.

For Australians, exposure may extend to online banking, ATO accounts, My Health Record, email, and work systems. Under the Privacy Act 1988 and the Notifiable Data Breaches scheme, organisations must assess eligible breaches and notify those likely to cause serious harm. The Australian Cyber Security Centre and Report Cybercrime provide guidance; suspected payment or identity fraud can also be reported to the relevant bank and Scamwatch.

Observed behaviour	Likely explanation	Best first action
Input works outside one app	Injected code, malicious overlay or extension	End the suspect process and test another account
One app ignores clicks or typing	Focus theft or blocked input hook	Use Task Manager or Force Quit
Entire system ignores input	Persistence, driver issue or graphics fault	Isolate the device and test Safe Mode
External keyboard and mouse also fail	Port, pairing, driver or hardware fault	Test another port and a clean device

Separate a Program Fault From an Infection

Open the affected app alone and watch for a hidden panel or focus that jumps away. Try another program and user profile. If one executable is affected, injection or a malicious extension is likelier; if every window fails, test persistence and graphics components.

Try Ctrl+Shift+Esc for Windows Task Manager, Alt+F4 for the foreground window, and Option+Command+Esc for macOS Force Quit. If Task Manager opens, end the suspect process. Record what responds to distinguish a malware lock from a crashed interface or failed driver.

Contain the Suspect Session

Cut network access without deleting evidence. Photograph any ransom note, filenames, and errors, then list recent downloads and installed programs. Avoid banking, ATO, My Health Record, and work logins from the suspect session, and do not use its USB ports on a trusted device.

If encryption is progressing, contact a qualified responder before choosing between observation and shutdown. Power loss may stop some ransomware, but restarting can erase runtime evidence. If nothing is changing, leave the machine powered for controlled troubleshooting rather than launching the suspect program again.

Recover Access on Windows

On Windows, use the on-screen keyboard under Settings, Accessibility, Keyboard if clicks work but text entry fails. Reboot into Safe Mode through Windows Recovery, then run a full scan with trusted security software. These practical recovery tips can help identify persistent startup items and remove suspicious software without normal desktop access.

Do not delete unfamiliar drivers or system folders by name, and do not test suspect files again. If Safe Mode is blocked, use known-clean rescue media, preserve recoverable documents, and seek professional help. An offline scan can inspect boot-starting threats, but it does not replace preserving encrypted files or changing exposed credentials.

Check macOS and External Devices

On a Mac, use Force Quit and Activity Monitor, then check login items, configuration profiles, extensions, and permissions under System Settings. Restart in Safe Mode when available and remove only incident-related items. Input that fails across every account and application may indicate a device or driver fault rather than malware.

Test wired peripherals in another port and re-pair Bluetooth accessories after removing unfamiliar devices. Malware can interfere with input software, but rarely damages hardware. If the built-in keyboard fails, connect a trusted USB keyboard; if all controls fail on another computer too, arrange hardware servicing.

Protect Files and Exposed Accounts

Ransomware often renames files, adds extensions, drops notes, or deletes shadow copies. If these signs appear, do not reset, reimage, or run aggressive cleaners. Preserve the drive and consult ransomware recovery guidance first, because storage changes can determine whether intact originals remain recoverable.

From a clean device, change exposed passwords, revoke sessions, and enable multifactor authentication. Contact the bank if online banking credentials were entered, and notify an employer if work data was accessed. Australian organisations should assess notification duties under the Privacy Act 1988 and the Notifiable Data Breaches scheme.

Reduce the Chance of Recurrence

Many infections arrive through attachments, cracked software, fake installers, or compromised sites. In Sydney, Melbourne, and other cities, avoid sensitive work on café or airport Wi-Fi unless a trusted VPN is active; a VPN does not make an infected device safe. Remove unused extensions and download updates from vendor sites.

Keep automatic updates on, use reputable endpoint protection, and require multifactor authentication for email, banking, and remote work. Australian small businesses can reduce recurrence with managed backups, endpoint monitoring, and controls blocking unsigned installers. Follow Cyber Security Centre incident advice and treat an input lock, disabled security tools, and changed files as one security event.

Immediate Response Checklist

Work in order: isolate, document, identify the scope, recover access from a clean environment, then rebuild. If the machine remains unstable, do not keep clicking warnings or enter payment details to test a dialog. A trusted device should handle communications, password resets, and evidence transfer.

Before rebuilding, preserve logs, screenshots, affected filenames, and accounts used on the system. Decide whether business, financial, personal, or government data is involved, then involve the appropriate institution early. Keep the original machine available for examination unless a responder advises otherwise.

• Disconnect Ethernet and Wi-Fi, and stop launching the blocked application.
• Record the symptoms, recent downloads, affected accounts, and any changed filenames.
• Change exposed credentials from a clean device and enable multifactor authentication.
• Preserve recoverable data, notify relevant institutions, and avoid erasing the infected drive.

Containment is complete only when the source is removed, exposed credentials are secured, affected files have a recovery path, and normal input works from a trusted account. This sequence prevents a local input lock from becoming identity theft, payment fraud, or wider ransomware damage.