Virus and Spyware Removal Guides, uninstall instructions

What is "$CATS Airdrop Live"?

During our examination of the site (catzclaim.pages[.]dev) promoting a $CATS airdrop, we found that it is not a legitimate crypto giveaway. Usually, these types of scams are used to extract money or personal information from unsuspecting individuals. Thus, it is advisable not to trust this platform.

What is the fake "Lido $stETH Airdrop"?

"Lido $stETH Airdrop" is a scam that imitates the Lido platform (lido.fi). It lures users with an stETH cryptocurrency token airdrop. However, this giveaway is fake and it is not associated with Lido or any other existing platforms and entities.

This "Lido $stETH Airdrop" scheme is a cryptocurrency drainer that aims to siphon digital assets from victims' cryptowallets.

What is the fake "EtherMail ($EMT) Airdrop"?

While investigating deceptive sites, our researchers discovered this fake "EtherMail ($EMT) Airdrop". The scam impersonates the EtherMail platform (ethermail.io) running an EMT (EMAIL) token airdrop.

It must be emphasized that this giveaway is fake, and it is not associated with the real EtherMail or any other existing platforms and entities. This scam is a crypto drainer seeking to steal digital assets stored in victims' cryptocurrency wallets.

What is "Roundcube - Unusual Login Attempt"?

Our team has checked this email and learned that it masquerades as an alert from an email service provider. Scammers behind this fraudulent email aim to lure recipients into opening a fake website and disclosing personal information. Scams of this type are known as phishing attempts. Recipients should ignore such emails.

What kind of malware is XIXTEXRZ?

While browsing new malware submissions to VirusTotal, our researchers discovered the XIXTEXRZ ransomware. Malicious software of this kind encrypts files and demands ransoms for the decryption.

On our test machine, XIXTEXRZ encrypted files and appended their names with a ".crypted" extension. To elaborate, an original filename such as "1.jpg" appeared as "1.jpg.crypted", "2.png" as "2.png.crypted", and so on.

Once the encryption process was completed, XIXTEXRZ ransomware changed the desktop wallpaper and created a ransom note titled "Readme.txt".

What is the fake "Soneium Registration" website?

While inspecting rogue pages, our researchers discovered this fake "Soneium Registration" website (event-soneium[.]org; note that it could be hosted elsewhere).

It is presented as a blockchain platform, but this scam page is not associated with existing ones or any legitimate entities. This scheme functions as a crypto drainer, i.e., it transfers digital assets from exposed cryptocurrency wallets.

What is the fake "Node AI" page?

We have inspected the page (register.nodeainetwork[.]com) and discovered that it is a fraudulent website mimicking nodes[.]ai, a legitimate platform. The purpose of the fake web page is to trick visitors into taking action that could lead to significant financial losses. Therefore, this website should be ignored/avoided.

What is "Binance USDC Distribution"?

During our analysis of the page (binance-airdrop-carv[.]info), we determined that it is a scam website. It is designed to trick visitors into believing they can participate in a cryptocurrency giveaway. Scammers behind this fraudulent scheme aim to trick unsuspecting individuals into taking actions that could result in financial losses.

What kind of page is ationiamcur[.]com?

Our researchers found ationiamcur[.]com while browsing untrustworthy sites. This rogue page is designed to promote spam browser notifications and generate redirects to various (likely dubious/dangerous) websites.

Ationiamcur[.]com and similar webpages are most commonly accessed via redirects caused by sites that use rogue advertising networks.

What kind of page is awksqa[.]com?

Our examination of awksqa[.]com has revealed that the website uses clickbait to deceive visitors into granting it permission to display notifications. Web pages like awksqa[.]com often promote other untrustworthy sites. Thus, users should not visit them and never accept their notifications.