Virus and Spyware Removal Guides, uninstall instructions

What is the fake "SONIC Airdrop"?

We have analyzed this page (alrdrop-0xsonlciabs[.]com) and found that it offers individuals the opportunity to participate in a cryptocurrency giveaway. However, this giveaway and similar sites should not be trusted. It is just a lure designed to trick people into taking actions that may lead to financial losses.

What kind of page is celebfinancenews[.]com?

Celebfinancenews[.]com is a rogue webpage discovered by our researchers during a routine investigation of untrustworthy sites. Upon inspection, we learned that this page endorses browser notification spam and redirects users to different (likely dubious/malicious) websites.

The majority of visitors to webpages like celebfinancenews[.]com access them through redirects caused by sites utilizing rogue advertising networks.

What kind of page is av-com.co[.]in?

Our researchers discovered the av-com.co[.]in rogue page while investigating suspect websites. Upon examination, we determined that this webpage promotes browser notification spam and redirects visitors to different (likely unreliable/hazardous) sites. Most users access pages like av-com.co[.]in via redirects caused by websites utilizing rogue advertising networks.

What kind of page is bestntmads24[.]com?

While browsing suspicious sites, our researchers discovered the bestntmads24[.]com rogue page. It is intended to promote spam browser notifications and produce redirects leading to other (likely dubious/dangerous) websites.

Users primarily access webpages like bestntmads24[.]com through redirects caused by sites that utilize rogue advertising networks.

What is the fake "Fantom Airdrop" website?

This "Fantom Airdrop" is fake. We found this scam on phntm-found.pages[.]dev, yet it could be hosted elsewhere. This hoax giveaway is supposedly distributing Fantom (FTM) tokens. Instead, the scheme operates as a cryptocurrency drainer.

It must be stressed that this fake "Fantom Airdrop" is in no way associated with the actual Fantom platform (fantom.foundation) or any others.

What kind of email is "Account Validation"?

After inspecting this "Account Validation" email, we determined that it is spam. This message claims the recipient risks having their email account permanently disabled unless it is verified. The purpose of this mail is to deceive recipients into disclosing their log-in credentials to a phishing website.

What kind of malware is Darkadventurer?

While inspecting Darkadventurer, we found that it is a ransomware variant based on Chaos ransomware. Darkadventurer encrypts files, appends random extensions to filenames, changes the desktop wallpaper, and drops a ransom note ("read_it.txt" file). An example of how it renames files: it changes "1.jpg" to "1.jpg.lftl", "2.png" to "2.png.h80x", and so forth.

What is the fake "$MPEPE PRESALE" website?

Our researchers discovered this fake "$MPEPE PRESALE" while investigating dubious websites. The scam site is supposedly running a presale event for the Mpeppe (MPEPE) memecoin. Instead, it operates as a phishing scam and targets cryptowallet log-in credentials.

What is the fake "Unichain Rewards" website?

We found this fake "Unichain Rewards" site – unichain-quest[.]com – (could be hosted elsewhere) while investigating deceptive websites. This scam promises rewards for bridging. Instead of granting any benefits, this fraudulent webpage facilities a crypto drainer. Basically, the scheme steals digital assets from victims' cryptowallets.

It must be stressed that regardless of potential visual similarities, this scam is not associated with any existing projects, platforms, or entities.

What is the fake "MANTRA Registration" website?

While investigating suspicious websites, our researchers discovered the "MANTRA Registration" scam (mainnet-mantra[.]trade; could be hosted elsewhere). The scheme promises various rewards for registration, and when users attempt to register – they expose their digital wallets to a cryptocurrency drainer. Essentially, this scam steals funds from victims' wallets.