{"id":5924,"date":"2017-11-04T13:36:43","date_gmt":"2017-11-04T08:06:43","guid":{"rendered":"http:\/\/198.58.113.91\/blog\/?p=5924"},"modified":"2023-07-31T17:58:41","modified_gmt":"2023-07-31T12:28:41","slug":"black-screen-command-prompt-open-logon-no-explorer-shell","status":"publish","type":"post","link":"https:\/\/www.winhelponline.com\/blog\/black-screen-command-prompt-open-logon-no-explorer-shell\/","title":{"rendered":"Black Screen and Command Prompt Open at Logon – No Explorer Shell"},"content":{"rendered":"

Due to a crypto-malware infection<\/a> in the computer, after logging in to your user account, a black screen appears with a Command Prompt window open. Your desktop, taskbar, and the wallpaper (explorer shell) don’t get loaded unless you type explorer.exe<\/code> in the Command Prompt window manually. This problem may continue even in the aftermath of malware or crypto-miner removal.
\n
\n\"black<\/p>\n

The malware may have changed the registry settings such that Command Prompt opens up at every login, and automatically executes a rogue program\/command-line using the Command Processor’s Autorun<\/a><\/code> registry value.<\/p>\n

\n

If you use Microsoft’s Autoruns utility<\/a> to manage Windows startup<\/a>, you’ll see that the Winlogon\\Shell<\/code> value is added (under HKEY_CURRENT_USER<\/code> — as a per-user override) by malware.<\/p>\n

\"shell
%comspec% set as the default shell for the current user<\/figcaption><\/figure>\n<\/div>\n

Solution for Black Screen and Command Prompt at Startup Issue<\/h3>\n

To fix the problem, follow these steps:<\/p>\n

    \n
  1. In the Command Prompt window, type explorer.exe<\/code> and press Enter<\/kbd><\/li>\n
  2. Start the Registry Editor (Regedit.exe<\/code>) and go to the following branch:\n
    HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon<\/pre>\n
    \"shell<\/li>\n
  3. In the right-pane, right-click on the Shell<\/code> registry value and choose Delete.<\/li>\n
  4. Right-click on the Winlogon<\/code> key, and click Go to HKEY_LOCAL_MACHINE<\/strong> to jump to the equivalent<\/a> registry key under the HKEY_LOCAL_MACHINE<\/code> root key. You’ll now be taken to the following key:\n
    HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon<\/pre>\n<\/li>\n
  5. Make sure that the Shell<\/code> value is set to explorer.exe
    \n<\/code>\"shell<\/li>\n
  6. Then, go to the following key:\n
    HKEY_CURRENT_USER\\Software\\Microsoft\\Command Processor<\/pre>\n<\/li>\n
  7. If the value named Autorun<\/code> exists, right-click, and choose Delete.<\/li>\n
  8. Exit the Registry Editor.<\/li>\n
  9. Follow up with a full system scan using Malwarebytes as well as your anti-virus software with updated definitions if you haven’t done it already.<\/li>\n<\/ol>\n","protected":false},"excerpt":{"rendered":"
    Due to a crypto-malware infection in the computer, after logging in to your user account, a black screen appears with a Command Prompt window open. Your desktop, taskbar, and the wallpaper (explorer shell) don’t get loaded unless you type explorer.exe in the Command Prompt window manually. This problem may continue even in the aftermath of … Read more<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[7],"tags":[303,441],"class_list":["post-5924","post","type-post","status-publish","format-standard","hentry","category-windows","tag-malwarebytes","tag-registry"],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"jetpack-related-posts":[{"id":28839,"url":"https:\/\/www.winhelponline.com\/blog\/cant-open-cmd-after-uninstalling-python-anaconda\/","url_meta":{"origin":5924,"position":0},"title":"Can’t Open CMD.exe After Uninstalling Python\/Anaconda; Exit Code 1","author":"Ramesh","date":"September 29, 2022","format":false,"excerpt":"After uninstalling Python\/Anaconda on your Windows computer, Command Prompt may not open. When you run cmd.exe, it flashes on the screen and immediately quits. Also, running DISM and SFC (to repair corrupt system files), repairing Windows installation, and running a thorough malware scan may not fix the issue. Also, when\u2026","rel":"","context":"In "Windows"","block_context":{"text":"Windows","link":"https:\/\/www.winhelponline.com\/blog\/category\/microsoft\/windows\/"},"img":{"alt_text":"vscode cmd.exe error 1","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2022\/09\/vscode-cmd-error-code-1.png?resize=350%2C200&ssl=1","width":350,"height":200},"classes":[]},{"id":4813,"url":"https:\/\/www.winhelponline.com\/blog\/cmd-here-windows-10-context-menu-add\/","url_meta":{"origin":5924,"position":1},"title":"Add “Open command window here” to Context Menu in Windows 10","author":"Ramesh","date":"December 13, 2016","format":false,"excerpt":"In the recent versions of Windows 10 (Creators Update and higher), the \"Open Command Prompt here\" context menu entry has been removed and is replaced by \"Open PowerShell window here\". Microsoft, in an effort to bring the best command line experiences to the forefront for all power users, has made\u2026","rel":"","context":"In "Windows 10"","block_context":{"text":"Windows 10","link":"https:\/\/www.winhelponline.com\/blog\/category\/microsoft\/windows\/windows-10\/"},"img":{"alt_text":"cmdhere context menu icon","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2016\/12\/cmdhere-context-menu.png?resize=350%2C200&ssl=1","width":350,"height":200},"classes":[]},{"id":3097,"url":"https:\/\/www.winhelponline.com\/blog\/edit-registry-offline-windows-re\/","url_meta":{"origin":5924,"position":2},"title":"How to Edit the Registry Offline Using Windows Recovery Environment","author":"Ramesh","date":"May 9, 2016","format":false,"excerpt":"Sometimes, you may need to edit the Windows registry offline to rectify a situation where Windows doesn't boot after modifying some settings recently. Windows Recovery Environment (WinRE) is a handy platform that provides various system recovery options to diagnose and repair an unbootable Windows installation. This post explains how to\u2026","rel":"","context":"In "Windows"","block_context":{"text":"Windows","link":"https:\/\/www.winhelponline.com\/blog\/category\/microsoft\/windows\/"},"img":{"alt_text":"windows re bcdedit osdevice","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2016\/05\/winre-bitlocker-prompt.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2016\/05\/winre-bitlocker-prompt.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2016\/05\/winre-bitlocker-prompt.png?resize=525%2C300&ssl=1 1.5x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2016\/05\/winre-bitlocker-prompt.png?resize=700%2C400&ssl=1 2x"},"classes":[]},{"id":3152,"url":"https:\/\/www.winhelponline.com\/blog\/windows-script-host-disabled-machine-contact-administator\/","url_meta":{"origin":5924,"position":3},"title":"[Fix] Windows Script Host Access is Disabled on this Machine","author":"Ramesh","date":"May 24, 2016","format":false,"excerpt":"When you run a Windows script using wscript.exe or cscript.exe, error Windows Script Host access is disabled on this machine may pop-up. However, in systems affected by malware, the error appears at regular intervals, without any script invocation by the user. So the key questions are: Which script is being\u2026","rel":"","context":"In "Windows"","block_context":{"text":"Windows","link":"https:\/\/www.winhelponline.com\/blog\/category\/microsoft\/windows\/"},"img":{"alt_text":"regedit icon","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2018\/07\/regedit-icon-small.png?resize=350%2C200&ssl=1","width":350,"height":200},"classes":[]},{"id":1520,"url":"https:\/\/www.winhelponline.com\/blog\/open-elevated-command-prompt-windows\/","url_meta":{"origin":5924,"position":4},"title":"How to Open Elevated or Admin Command Prompt in Windows?","author":"Ramesh","date":"March 5, 2007","format":false,"excerpt":"Command Prompt is one of the most used tools in Windows. For tasks requiring administrator privileges, we need to start Command Prompt as administrator (\"elevated\"). This article describes different ways to open an elevated or administrator Command Prompt window. How to Open Elevated or Admin Command Prompt From the Win-X\u2026","rel":"","context":"In "Windows"","block_context":{"text":"Windows","link":"https:\/\/www.winhelponline.com\/blog\/category\/microsoft\/windows\/"},"img":{"alt_text":"task manager -run command prompt elevated - create new task","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2007\/03\/taskmgr-cmd-elevated.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2007\/03\/taskmgr-cmd-elevated.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2007\/03\/taskmgr-cmd-elevated.png?resize=525%2C300&ssl=1 1.5x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2007\/03\/taskmgr-cmd-elevated.png?resize=700%2C400&ssl=1 2x"},"classes":[]},{"id":25702,"url":"https:\/\/www.winhelponline.com\/blog\/get-back-windows-10-ribbon-ui-windows-11\/","url_meta":{"origin":5924,"position":5},"title":"Get Back Windows 10 Ribbon UI in Windows 11 File Explorer","author":"Ramesh","date":"January 15, 2022","format":false,"excerpt":"The File Explorer in Windows 11 has a new\/modern ribbon interface with small icons (no caption text underneath). The new ribbon interface may look bland and uncomfortable for new users who have upgraded to Windows 11 from Windows 10 or earlier. Luckily, there are many different ways to get back\u2026","rel":"","context":"In "Windows 11"","block_context":{"text":"Windows 11","link":"https:\/\/www.winhelponline.com\/blog\/category\/microsoft\/windows\/windows-11\/"},"img":{"alt_text":"get ribbon script winlogon shell","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2022\/01\/winlogon-replace-ribbon-script.png?resize=350%2C200&ssl=1","width":350,"height":200},"classes":[]}],"_links":{"self":[{"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/posts\/5924","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/comments?post=5924"}],"version-history":[{"count":0,"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/posts\/5924\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/media?parent=5924"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/categories?post=5924"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/tags?post=5924"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}