Comunity website classpad.dev gets merked as ClickFix malware.

[u/QBos07]

Hi, I am a core member of the Hollyhock community wich is focused around classpad II / fx-CP400 / fx-CG50 modding.

The website https://classpad.dev which is run by the Hollyhock comunity gets its installer blocked by uBO's ClickFix protection. We use a common irm https://get.classpad.dev/ | iex as no existing installer infratructure could accommedate our needs of usually but not allways preinstalled dependecies and one time use programms. We do not use WIN + R as that triggers windows defender antivirus but rather opt for the user manually opening powershell.

With recent uBO the copy button ceases to function and a banner gets displayed about a potential ClickFix attack.

Source code of the "installer" is avaiable on GitHub. The source of the program itself is private because of the high potantial for exam mode bypasses wich would hurt the comunity a lot but if access is needed I/we can arange something.

[u/RraaLL]

You can check if this also resolves the issue on your side: https://www.reddit.com/r/uBlockOrigin/comments/1w3sc2v/bad_clickflix_filter_matching_all_clipboards/

[u/QBos07 → u/RraaLL]

I tried the fix but it sitll gets flagged.

[u/AchernarB → u/QBos07]

I think that in your site's case it is the intended purpose. It's to warn users of a potentially dangerous (for them) command. The filter displays the actual content of the paste to allow the user to manually copy+paste.

[u/gta721]

Why don't you use an MSI installer?

[u/QBos07 → u/gta721]

The program is a flasher and patcher for the calculator firmware we are modding. Most people neither need nor want it installed permamently. That is not something the usual MSI installer (or any other installer framework) support.

[u/gta721 → u/QBos07]

What about a zip folder containing the program's files?

[u/QBos07 → u/gta721]

Was one of the possible options but there were issues:

• users trying to run without full extraction
  
• antimalware false alarms
  
• does not manage dependencies

[u/RraaLL]

With recent uBO the copy button ceases to function and a banner gets displayed about a potential ClickFix attack.

Isn't the full prompt displayed there and possible to select and copy?

[u/QBos07 → u/RraaLL]

Yes the promp is displayed and can be manualy selected and copied

[u/delightfulsorrow]

We use a common irm https://get.classpad.dev/ | iex

Something like that is "common" only for one kind of "installer".

[u/QBos07 → u/delightfulsorrow]

If I interpret this as "installer" meaning malware than that is not true. The pattern is older then the ClickFix malwares abusing it. Oldest I can think of is massgrave but other new project like Bun and Deno to name a few are also using it.

EDIT: To add that there is a similar method in linux and sometimes macos using `curl | bash` aswell.

[u/delightfulsorrow → u/QBos07]

The pattern is older then the ClickFix malwares abusing it.

Similar pattern (getting users to manually download and run malicious code) are a thing since the mid 2000s. ClickFix is just the latest manifestation.

Legit projects using the same methods are what ENABLES that. It trains users to follow such instructions.

To add that there is a similar method in linux and sometimes macos using curl | bash aswell.

It is even older there (before PowerShell and Invoke-RestMethod, Windows didn't have the required tools onboard.) But that doesn't make it better.

[u/_Archimage_]

it's a widespread bug. I'm getting from a lot of websites. Something is wrong on the ublock code.

[u/AchernarB → u/_Archimage_]

It was a filter too broad. It has already been fixed. Give uBO the time to update the list.

See https://www.reddit.com/r/uBlockOrigin/comments/1w3sc2v/bad_clickflix_filter_matching_all_clipboards/