1. Test Assistance: What to do if the test virus executed on your system?

Basic Test: The basic test displays only a single window. Once you close this window, the test is complete. Since the attack operates through the clipboard, you may clear it for peace of mind, though this is not strictly necessary for security purposes.

Using the keyboard combination ‘Windows key + V’ will likely show our ‘attack’ in your clipboard history. There is a ‘Clear all’ button in the top right corner that will remove the last traces of our ‘attack’ from your system.

For Mac users: The attack works differently but also operates through the clipboard, similar to Windows. On Mac, you can close the windows (in this case two) and nothing will remain. If you wish to clear the clipboard, simply copy an empty text (or any other content of your choice). Mac systems are more secure than Windows in this regard, as they do not maintain clipboard history by default—one new copy action will overwrite the previous item.

Advanced Test: This test performs more modifications beyond simply launching a PowerShell script. It creates a file at C:\Temp\clickfixdemo.txt and (without you noticing) sends an email to samples@click-fix.nl to demonstrate that outbound emails are possible. This email contains no data except the test ID, which is unique and visible on your screen during the test. This demonstrates during security audits that an email was actually sent. In addition to the basic test instructions, you should also delete the file at C:\Temp. Note that this text file also indicates which test was performed, demonstrating that a ransomware attack or information stealer would have succeeded if this had been a real attack.