uasputnik.com: a Windows ClickFix malware site serving .msi installers, and what to do if you ran one

What uasputnik.com is, and what we know about it

uasputnik.com is a web address, not a program on your PC. It is a domain that the abuse.ch project URLhaus lists as a place where malware was served: three Windows installer files, two with the tag ClickFix. No public write-up of this one domain exists that we could find, so this page rests on what URLhaus shows, what we saw ourselves and what Microsoft has published about the trick.

1. 1

   What URLhaus lists

   Three file addresses on uasputnik.com, all in the top folder of the site and all ending in .msi: neon.msi, astra.msi and relax.msi. On 17 September 2026 an anonymous reporter added neon.msi with the tags ClickFix and msi, and a minute later the reporter alister1448 added astra.msi with the tags ClickFix, Loader and msi. On 29 September 2026 abuse.ch itself added relax.msi with the tag msi. All three have the threat type malware_download and were offline when we read them.

2. 2

   What the tags mean

   msi is the ending of a Windows Installer package, the kind of file that installs a program. ClickFix is a trick in which a fake verification or fix page makes you copy a command and run it yourself. Loader is the reporter's word for a program whose job is to download or start something else. They are the reporters' labels, not our findings.

3. 3

   What we could not confirm

   We did not download any of the files and we never saw the page that tells visitors what to paste. So we do not know the lure, what the installers contain, which malware family they bring or whether the three belong to one chain. Our site test was refused, so we cannot see the site as a visitor would.

4. 4

   What this means for you

   If you only saw the name in a log, a link or a warning, you are not infected by that alone. The risk is for people who pasted a command from the site into the Run box or PowerShell, or who opened an .msi file from it.

Kind of threat

A malware download address; three Windows installer (.msi) files, two tagged ClickFix, one also tagged Loader

Delivery trick

ClickFix: a fake page asks you to copy a command and paste it into Run, Terminal or PowerShell

Domain registered

9 September 2026, expires 9 September 2027, registrar Gransy, s.r.o. (RDAP, read 9 October 2026)

URLhaus entries

3 file addresses, added 17 and 29 September 2026; all offline when we read them

Platform

Windows, by the msi tag. No source says which other systems are hit

What we checked on 9 October 2026, and what we could not

We opened https://uasputnik.com/ once, from Lithuania, in an automated Chromium browser set to English. The connection was refused and no page loaded. That tells you nothing good about the site, and it clears nothing.

What happened to uasputnik.com, from registration to our test

The history is short: the domain is a month old and its first report came eight days after registration. The dates come from RDAP and from the URLhaus database.

1. 9 September 2026

   The domain is registered

   RDAP shows uasputnik.com registered on 9 September 2026 through the registrar Gransy, s.r.o., valid until 9 September 2027. We found nothing that shows a real organisation behind the name.

2. 17 September 2026

   Two ClickFix installers are reported

   At 05:44 UTC an anonymous reporter adds neon.msi with the tags ClickFix and msi. At 05:45 UTC the reporter alister1448 adds astra.msi with the tags ClickFix, Loader and msi. This is the first time URLhaus sees the host.

   

3. 29 September 2026

   A third installer is added

   At 08:18 UTC abuse.ch adds relax.msi with the tag msi only. It is the same kind of file in the same folder, twelve days after the first two, so the site was still in use then.

4. 9 October 2026

   Our test is refused

   Our browser visit to https://uasputnik.com/ ends in ERR_CONNECTION_REFUSED. We do not know what a visitor who arrives from the lure page would see.

We could not read the URLhaus pages themselves, because they ask for a browser check. The entries above come from the same data in our own database, which holds the URLhaus feed.

How the ClickFix trick works on Windows, and where an .msi fits

ClickFix does not use a security hole. It makes you do the infecting yourself, so the warnings of your browser and your antivirus often never get a say. We did not see uasputnik.com's page; this is how Microsoft describes the trick.

1. 1

   You land on a page with a check

   Microsoft says the lure is often a fake CAPTCHA, human verification or error page, sometimes made to look like Cloudflare Turnstile or Google reCAPTCHA. It reaches you through phishing email, malicious ads or compromised sites.

2. 2

   The page copies a command for you

   A button puts a command on your clipboard through the browser, without showing it. The page then tells you to paste it into the Run dialog, Windows Terminal or PowerShell.

3. 3

   You open Run and paste

   The steps ask you to press the Windows key + R, press Ctrl + V and press Enter. Microsoft says the Run dialog is favoured because many users do not know what it is for.

4. 4

   The command fetches the real malware

   Microsoft says these commands usually call PowerShell, mshta, rundll32, wscript, curl or wget. Microsoft's own page does not describe an .msi route. Windows can install a package from a command with msiexec /i, and /qn or /quiet hides every window, according to Microsoft's msiexec page. We do not know that this is what the three files are for.

5. 5

   Nothing seems to happen

   A window that flashes and closes, or a CAPTCHA that never finishes, is the whole experience for many victims. Microsoft says the final payloads are often loaded into memory through built-in tools such as powershell.exe, msbuild.exe and regasm.exe.

Because a person starts the command, many automated defences treat it as normal. This is why the Run box history matters later: Windows records what was typed there, but only when the command worked.

The three files: what each name suggests, and what we do not know

File names are weak evidence. We list what URLhaus says about each and mark which statements are only a reading.

Three short names, all in the top folder, tell us only that the files were put there to be fetched by address. We fetched none of them, so we give no malware family name.

What a ClickFix payload on Windows can take

We do not know what uasputnik.com's installers contain. Microsoft names the payloads it has seen at the end of ClickFix chains, and the list below is those, not a claim about this site.

Microsoft groups these into infostealers (Lumma, Lampion), remote access tools (Xworm, AsyncRAT, NetSupport, SectopRAT, ScreenConnect), loaders (Latrodectus, MintsLoader, DarkGate) and one rootkit, a modified r77. The loader group matters most for this site, because astra.msi carries the Loader tag: a loader's first file is not the last.

What this can cost you

Reading the site name or seeing a warning costs nothing. The risks below apply to a PC where a pasted command was run, or an .msi file from the site was installed.

• High

  Your accounts used by someone else

  If the files hold a stealer, the saved logins and cookies in your browser are the prize. With a cookie, a thief can sit in your mailbox without knowing your password.

• High

  Money in a crypto wallet

  Wallet data is a common target and a transfer cannot be called back. If a wallet lived on this PC, treat it as emptied until proven otherwise.

• High

  A stranger at your keyboard

  A remote tool shows your screen to another person and lets them install more. The network cable is the first thing to pull.

• Medium

  A program that stays installed

  An .msi writes itself into the list of installed apps and can leave services or tasks behind. Until they are found, the PC keeps running them.

• Medium

  Your employer's data

  A work laptop carries tokens for company systems. Report it to your IT team the same day so they can cut those accounts.

• Low

  No harm from reading the name

  Seeing the address in a log, an alert or a blocked link does nothing to your PC.

What you may notice, and what you may not

Most victims notice nothing. The signs below follow from how ClickFix chains and Windows installers work; the first two are the best evidence you have.

How people end up on a page like this

We do not know how visitors reach uasputnik.com, and no source says. The routes below are the ones Microsoft names for ClickFix in general.

1. 1

   A phishing email with a link or attachment

   Microsoft names HTML attachments and links to ClickFix landing pages. The email says a document or delivery needs a check, and the page opens a fake verification.

2. 2

   A malicious ad

   Microsoft describes fake Play pages on free movie streaming sites, and a fake government site reached through an ad redirect.

3. 3

   A hacked website

   A normal site that was broken into shows the fake check on top of its own page. Microsoft says some such sites were probably hacked through WordPress weaknesses.

4. 4

   A fake fix for a Windows or browser problem

   Pages that claim a browser or Windows needs repair, or that a document cannot be shown until you fix it, end in the same paste step.

Check your Windows PC before you delete anything

Start with the question that matters: did you paste a command from a website into Run, Windows Terminal or PowerShell, or run an .msi file from uasputnik.com? If yes, follow the plan on this page, because a clean-looking check does not clear a PC. If you are not sure, do these checks first. None of them deletes anything.

While you check, stop using the PC for banking, email, work or crypto, and disconnect it from Wi-Fi and the network cable if you can.

1. 1

   Look in Installed apps

   Open Settings > Apps > Installed apps on Windows 11, or Settings > Apps > Apps & features on Windows 10. Sort by install date and look for a program you did not choose that appeared when you pasted the command. Write down its name and publisher. Do not uninstall it yet.

2. 2

   Find the line you pasted

   Run regedit, then browse to HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU. Every value there is something typed into Run. Photograph any line with uasputnik.com, powershell or msiexec in it, and leave it in place.

3. 3

   Open Task Scheduler

   Search for Task Scheduler in the Start menu, open the Task Scheduler Library and read any task with a random name or a recent date. Write the name down; deleting comes later.

4. 4

   Read the Windows Security history

   Windows Security > Virus & threat protection > Protection history lists what Defender caught and when. Windows 10 reaches the same page through Settings > Update & Security > Windows Security. Look for dates near your paste.

5. 5

   Do not read too much into a quiet result

   Deleting the RunMRU line hides the evidence and does not remove malware. Memory-only payloads leave nothing in these places, so a quiet check only lowers the doubt.

Scan from outside Windows: Microsoft Defender Offline

Most scans run inside the Windows that may be infected. This one starts first and looks at the system from outside, which is why Microsoft recommends it for stubborn malware.

A clean result is not a clearance. If a pasted command ran, or an installer from this site finished, plan to copy your documents out and reinstall Windows.

Uninstalling a program that came from the .msi

Only do this after the offline scan, and only if you know which entry it is. Removing a program does not remove what it already started.

1. 1

   Use Installed apps

   In Settings > Apps > Installed apps, select the three dots next to the entry and choose Uninstall. On Windows 10 use Apps & features and select Uninstall. Windows Installer packages remove themselves this way, as Microsoft's msiexec page describes with its /x option for uninstalling a package.

2. 2

   Then check what is left

   Look again at Task Scheduler and at shell:startup (Windows key + R) for files you did not make. Run the offline scan once more.

3. 3

   Do not trust the uninstall alone

   If the package was a loader, it may already have fetched other programs that have no entry in the list. This is why we end the plan with a reinstall.

If you use a Mac, an iPhone or an Android phone

The msi tag points at Windows. We found nothing that says the three files run on anything else.