Riskware/RstoroReImageRepair Riskware/RstoroReImageRepair is a generic detection for an unwanted application. Grayware samples that are detected as such may have varying behaviour. Below are some of its observed characteristics/behaviours: The application appears to be intended for optimizing and/or fixing Windows PC and other software components. This would involve scanning/querying the hosts system installation registry, and other application installation and other software components of the user hosts. However the vendor requires you purchase the license/registration before obtaining the "repair" functionality/capability.
In some of our tests the installer requires that the Windows firewall be altered to have the installer to allow to pass thru.
Samples were observed as well to connect to a certain cloud.restor[Removed].com
Below are some illustration of the Installation: Figure 1: User Interface. Figure 2: Function to Repair requires license/registration purchase. Figure 3: Payment price. Figure 4: Windows firewall being advised to be altered. Following are some of the near/exact IOCs/file hash associated with this detection: Md5: 288046a4e0ecf01a27e8a38445a81e5f Sha256: 792d28dedb30066a8de5b052297205ff7bca16bc9760d76e38605ce9bfe22256
Make sure that your FortiGate/FortiClient system is using the latest AV database.
Quarantine/delete files that are detected and replace infected files with clean backup copies.
