Virus and Spyware Removal Guides, uninstall instructions

What is the fake "Aave check eligibility" website?

While investigating suspicious websites, our research team discovered this "Aave check eligibility" scam on app-aave[.]co (keep in mind it could be hosted elsewhere). Regardless of potential visual similarities, this deceptive page is not associated with any existing projects, platforms, or entities. The scheme operates as a cryptocurrency drainer – by stealing digital assets from exposed cryptowallets.

What kind of malware is Niko?

Niko is ransomware (belonging to the Makop family) that we discovered while examining malware samples uploaded to VirusTotal. Niko encrypts files and appends a string of random characters (likely the victim's ID), an email address, and the ".niko" extension to filenames. Also, it drops a ransom note named "+README-WARNING+.txt".

An example of how Niko modifies filenames: it renames "1.jpg" to "1.jpg.[42990E91].[proof3200@proton.me].niko", "2.png" to "2.png.[42990E91].[proof3200@proton.me].niko", and so forth.

What kind of malware is Sauron?

Discovered by S!Ri, Sauron is a ransomware-type program. Malicious software of this kind is designed to encrypt files and demand payment for the decryption.

After we executed a sample of this ransomware on our test machine, it encrypted files and appended their names with a unique ID assigned to the victim, the cyber criminals' email address, and a ".Sauron" extension. For example, a file initially titled "1.jpg" looked like "1.jpg.[ID-35AEE360].[adm.helproot@gmail.com].Sauron".

Once the encryption process was finished, Sauron changed the desktop wallpaper and dropped a ransom-demanding message titled "#HowToRecover.txt".

What kind of page is deszubaton[.]com?

Our examination of deszubaton[.]com revealed that it presents misleading content and requests permission to send notifications. Visiting the site and granting it permission to show notifications can put users at risk of various scams and threats. Therefore, it is strongly recommended not to trust deszubaton[.]com and to close the site if it is encountered.

What is the fake "$BabyElon Allocation" website?

While inspecting untrustworthy websites, our researchers discovered this fake "$BabyElon Allocation". We found this scam on babyelon-claim[.]net, yet it could be hosted elsewhere. Although it claims to be distributing the BabyElon memecoin, this deceptive webpage acts as a crypto drainer. Victims of this scheme experience financial loss.

What kind of page is doukoula[.]com?

Our team has inspected doukoula[.]com and concluded that it is a deceptive website designed to obtain permission to show notifications. Doukoula[.]com uses clickbait to trick visitors into granting it this permission. It is highly advisable to avoid visiting websites like doukoula[.]com and never grant them any permissions.

What is the fake "Reown Registration" site?

While inspecting the site (register-reown[.]xyz), we found that it mimics the Reown platform (reown[.]com). It is a fake website created by scammers who seek to deceive unsuspecting individuals into taking actions that can lead to the theft of their cryptocurrency holdings. Thus, it is highly advisable to avoid visiting sites like register-reown[.]xyz.

What kind of scam is "(5) Virus/Malware infections have been detected"?

Our researchers discovered the "(5) Virus/Malware infections have been detected" scam during a routine investigative session of suspicious sites. Upon inspection, we determined that it is a technical support scam.

This deceptive webpage is disguised as Microsoft's official website and alerts visitors of various threats on their devices. Tech support scams are elaborate; their initial goal is to get victims to call their fake helplines and allow cyber criminals to connect to their systems remotely.

What kind of page is jaikaijoup[.]com?

Our inspection of jaikaijoup[.]com has shown that it displays deceptive content and asks for permission to send notifications. Visiting and allowing it to show notifications can expose users to various scams and other threats. Thus, it is highly advisable not to trust jaikaijoup[.]com and close it if ever opened.

What is the fake "SONIC Airdrop"?

We have analyzed this page (alrdrop-0xsonlciabs[.]com) and found that it offers individuals the opportunity to participate in a cryptocurrency giveaway. However, this giveaway and similar sites should not be trusted. It is just a lure designed to trick people into taking actions that may lead to financial losses.