Virus and Spyware Removal Guides, uninstall instructions

What is SagaDynasty?

While looking through new submissions to VirusTotal, our research team found the SagaDynasty rogue application. After analyzing this piece of software, we discovered that it operates as adware and is part of the AdLoad malware family.

What kind of page is lpnottech[.]com?

Lpnottech[.]com is a rogue webpage that we discovered while investigating untrustworthy sites. It operates by pushing spam browser notifications and redirecting visitors to different (likely unreliable/malicious) pages. Most users enter lpnottech[.]com and similar websites via redirects caused by pages using rogue advertising networks, spam notifications, intrusive ads, or installed adware.

What kind of page is jonne[.]club?

After examining the jonne[.]club website, we found that it is a deceptive page running the "McAfee - Your PC is infected with 5 viruses!" scam. Also, it wants to show notifications. We came across this site while analyzing illegal movie streaming pages, torrent sites, and other pages that use rogue advertising networks.

What kind of page is whatchnow[.]xyz?

While examining websites that use rogue advertising networks, we came across whatchnow[.]xyz - a page designed to trick visitors into allowing it to show notifications. There are numerous similar pages on the Internet. None of them can be trusted/should be allowed to show notifications.

What kind of page is jubsaugn[.]com?

During a routine inspection of untrustworthy sites, our researchers discovered jubsaugn.com. This rogue webpage promotes spam browser notifications by attempting to trick visitors into allowing their delivery. Additionally, this website can redirect users elsewhere, likely dubious/malicious pages.

Sites like jubsaugn[.]com are usually accessed through redirects caused by webpages using rogue advertising networks.

What kind of malware is Kriptor?

While checking the VirusTotal page for recently submitted malware samples, we came across Kriptor - ransomware that encrypts files. We also found that Kriptor appends ".Kriptor" extension to filenames, changes the desktop wallpaper, and drops the "read_it.txt" file (a ransom note) on a desktop.

An example of how Kriptor ransomware modifies filenames: it renames "1.jpg" to "1.jpg.Kriptor", "2.png" to "2.png.Kriptor","3.exe" to "3.exe.Kriptor", and so forth.

What is MotivePrime?

Our researchers discovered the MotivePrime rogue application while inspecting new submissions to VirusTotal. After analyzing this piece of software, we determined that MotivePrime operates as adware and is part of the AdLoad malware family.

What kind of page is notiftravel[.]com?

After examining the notiftravel[.]com page, we learned that it displays deceptive content (uses a clickbait technique) to trick visitors into agreeing to receive notifications. Also, this page redirects visitors to another page of this type. We discovered notiftravel[.]com while analyzing sites that use rogue advertising networks.

What kind of page is tools-basket[.]com?

While inspecting questionable pages that use rogue advertising networks, we found tools-basket[.]com - a page that wants to show notifications, displays deceptive content and promotes suspicious apps. After examining numerous pages similar to tools-basket[.]com we learned that none of them are trustworthy.

What is BasicEngine?

Our researchers found the BasicEngine rogue application while inspecting new submissions to VirusTotal. After analyzing this app, we determined that it works as advertising-supported software (adware) and is part of the AdLoad malware family.