Black Screen and Command Prompt Open at Logon – No Explorer Shell

Due to a crypto-malware infection in the computer, after logging in to your user account, a black screen appears with a Command Prompt window open. Your desktop, taskbar, and the wallpaper (explorer shell) don’t get loaded unless you type explorer.exe in the Command Prompt window manually. This problem may continue even in the aftermath of malware or crypto-miner removal.

The malware may have changed the registry settings such that Command Prompt opens up at every login, and automatically executes a rogue program/command-line using the Command Processor’s Autorun registry value.

If you use Microsoft’s Autoruns utility to manage Windows startup, you’ll see that the Winlogon\Shell value is added (under HKEY_CURRENT_USER — as a per-user override) by malware.

Solution for Black Screen and Command Prompt at Startup Issue

To fix the problem, follow these steps:

1. In the Command Prompt window, type explorer.exe and press Enter
2. Start the Registry Editor (Regedit.exe) and go to the following branch:

   HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon

   

3. In the right-pane, right-click on the Shell registry value and choose Delete.
4. Right-click on the Winlogon key, and click Go to HKEY_LOCAL_MACHINE to jump to the equivalent registry key under the HKEY_LOCAL_MACHINE root key. You’ll now be taken to the following key:

   HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

5. Make sure that the Shell value is set to explorer.exe

6. Then, go to the following key:

   HKEY_CURRENT_USER\Software\Microsoft\Command Processor

7. If the value named Autorun exists, right-click, and choose Delete.
8. Exit the Registry Editor.
9. Follow up with a full system scan using Malwarebytes as well as your anti-virus software with updated definitions if you haven’t done it already.