What is Restoro?
The Malwarebytes research team has determined that Restoro is a "system optimizer". These so-called "system optimizers" use intentional false positives to convince users that their systems have problems. Then they try to sell you their software, claiming it will remove these problems.
More information can be found on our Malwarebytes Labs blog.
How do I know if I am infected with Restoro?
This is how the main screen of the system optimizer looks:
You will find these icons in your taskbar, your startmenu, and on your desktop:
and see these warnings during install:
and these screens during "operations":
You may see this entry in your list of installed programs:
How did Restoro get on my computer?
These so-called system optimizers use different methods of getting installed. This particular one was downloaded from their website:
How do I remove Restoro?
Our program Malwarebytes can detect and remove this potentially unwanted application.
- Please download Malwarebytes to your desktop.
- Double-click mb3-setup-consumer-{version}.exe and follow the prompts to install the program.
- Then click Finish.
- Once the program has fully updated, select Scan Now on the Dashboard. Or select the Threat Scan from the Scan menu.
- If another update of the definitions is available, it will be implemented before the rest of the scanning procedure.
- When the scan is complete, make sure that all Threats are selected, and click Remove Selected.
- Restart your computer when prompted to do so.
- No, Malwarebytes removes Restoro completely.
We hope our application and this guide have helped you eradicate this system optimizer.
As you can see below the full version of Malwarebytes would have protected you against the Restoro installer. It would have warned you before the application could install itself, giving you a chance to stop it before it became too late.
and we block access to their domain.
Technical details for experts
You may see these entries in FRST logs:
(Restoro) C:\Program Files\Restoro\bin\RestoroProtection.exe (Restoro) C:\Program Files\Restoro\bin\RestoroService.exe (Restoro) C:\Program Files\Restoro\RestoroMain.exe R2 RestoroActiveProtection; C:\Program Files\Restoro\bin\RestoroProtection.exe [9070432 2018-08-07] (Restoro) C:\ProgramData\Restoro C:\Program Files\Restoro C:\Users\Public\Desktop\Restoro.lnk C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Restoro C:\Windows\restoro.ini Restoro (HKLM\...\Restoro) (Version: 2.0.0.4 - Restoro)Alterations made by the installer:
File system details [View: All details] (Selection)
---------------------------------------------------
Adds the folder C:\Program Files\Restoro
Adds the file ax.dll"="8/17/2018 8:56 AM, 284448 bytes, A
Adds the file ax.lza"="8/17/2018 8:56 AM, 108953 bytes, A
Adds the file engine.dll"="8/17/2018 8:56 AM, 12140872 bytes, A
Adds the file engine.lza"="8/17/2018 8:56 AM, 3843821 bytes, A
Adds the file LZMA.EXE"="8/5/2018 12:47 PM, 106496 bytes, A
Adds the file msvcr120.dll"="8/5/2018 12:47 PM, 970912 bytes, A
Adds the file Restoro Help & Support.url"="8/17/2018 8:56 AM, 101 bytes, A
Adds the file Restoro Privacy Policy.url"="8/17/2018 8:56 AM, 64 bytes, A
Adds the file Restoro Terms of Use.url"="8/17/2018 8:56 AM, 62 bytes, A
Adds the file Restoro Uninstall Instructions.url"="8/17/2018 8:56 AM, 59 bytes, A
Adds the file Restoro.exe"="8/17/2018 8:49 AM, 933536 bytes, A
Adds the file Restoro_SafeMode.ico"="8/5/2018 12:47 PM, 146184 bytes, A
Adds the file Restoro_uninstall.ico"="8/5/2018 12:47 PM, 144090 bytes, A
Adds the file Restoro_website.ico"="8/5/2018 12:47 PM, 145479 bytes, A
Adds the file RestoroAM.exe"="8/12/2018 11:13 AM, 1960816 bytes, A
Adds the file Restoroicon.ico"="8/5/2018 12:47 PM, 139789 bytes, A
Adds the file RestoroMain.exe"="8/12/2018 11:13 AM, 7542552 bytes, A
Adds the file RestoroSafeMode.exe"="8/5/2018 12:47 PM, 592240 bytes, A
Adds the file savapi.dll"="8/5/2018 12:47 PM, 1796416 bytes, A
Adds the file TechSupportApp.exe"="8/12/2018 11:22 AM, 7093584 bytes, A
Adds the file uninst.exe"="8/12/2018 11:23 AM, 955928 bytes, A
Adds the folder C:\Program Files\Restoro\bin
Adds the file RestoroProtection.exe"="8/7/2018 8:57 AM, 9070432 bytes, A
Adds the file RestoroScanner.exe"="8/7/2018 8:57 AM, 9122144 bytes, A
Adds the file RestoroService.exe"="8/7/2018 8:57 AM, 8465760 bytes, A
Adds the file RestoroUI.exe"="8/7/2018 8:47 AM, 5060960 bytes, A
Adds the file RestoroUpdater.exe"="8/7/2018 8:57 AM, 617080 bytes, A
Adds the folder C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Restoro
Adds the file Help & Support.lnk"="8/17/2018 8:56 AM, 1771 bytes, A
Adds the file Privacy Policy.lnk"="8/17/2018 8:56 AM, 1771 bytes, A
Adds the file Restoro.lnk"="8/17/2018 8:56 AM, 816 bytes, A
Adds the file Run in safe mode.lnk"="8/17/2018 8:56 AM, 1738 bytes, A
Adds the file Terms of Use.lnk"="8/17/2018 8:56 AM, 1761 bytes, A
Adds the file Uninstall Instructions.lnk"="8/17/2018 8:56 AM, 1811 bytes, A
Adds the file Uninstall.lnk"="8/17/2018 8:56 AM, 597 bytes, A
Adds the folder C:\ProgramData\Restoro
Adds the file conf.res"="8/17/2018 8:56 AM, 968400 bytes, A
Adds the file restoro.ext"="8/17/2018 9:00 AM, 192 bytes, A
Adds the file res-v01.ini"="8/17/2018 8:57 AM, 4960 bytes, A
Adds the file TechSupportApp.ini"="8/5/2018 12:47 PM, 752 bytes, A
Adds the folder C:\ProgramData\Restoro\AV
Adds the file avupdate.exe"="8/5/2018 12:47 PM, 1967224 bytes, A
Adds the file avupdate_msg.avr"="8/5/2018 12:47 PM, 6392 bytes, A
Adds the file cacert.crt"="8/5/2018 12:47 PM, 6065 bytes, A
Adds the file HBEDV.KEY"="8/5/2018 12:47 PM, 512 bytes, A
Adds the file msvcr120.dll"="8/5/2018 12:47 PM, 970912 bytes, A
Adds the file productname.dat"="8/5/2018 12:47 PM, 15 bytes, A
Adds the file savapi.exe"="8/5/2018 12:47 PM, 355840 bytes, A
Adds the file savapi_restart.exe"="8/5/2018 12:47 PM, 81256 bytes, A
Adds the file savapi_stub.exe"="8/5/2018 12:47 PM, 83248 bytes, A
Adds the file xbvRei.vdf"="8/17/2018 8:56 AM, 21 bytes, A
Adds the folder C:\ProgramData\Restoro\bin
Adds the file active_protection.txt"="8/17/2018 8:57 AM, 322736 bytes, A
Adds the file conf.res"="8/17/2018 8:57 AM, 968400 bytes, A
Adds the file urls.set"="8/17/2018 8:57 AM, 32344 bytes, A
Adds the folder C:\ProgramData\Restoro\bin\Results
Adds the file restoro-service-setup.log"="8/17/2018 8:57 AM, 12422 bytes, A
Adds the file restoro-service-updater.log"="8/17/2018 8:57 AM, 10274 bytes, A
Adds the folder C:\ProgramData\Restoro\Results\EXE2.0.0.4\RUN20180817_0857
Adds the file installed.rec"="8/17/2018 8:57 AM, 36592 bytes, A
Adds the file junk_results.xml"="8/17/2018 9:00 AM, 514 bytes, A
Adds the file out.log"="8/17/2018 8:57 AM, 0 bytes, A
Adds the file RegistryScanRes.xml"="8/17/2018 9:00 AM, 5120 bytes, A
Adds the file restoro.2.log"="8/17/2018 8:57 AM, 0 bytes, A
Adds the file restoro.log"="8/17/2018 8:57 AM, 0 bytes, A
Adds the file StabilityScanRes.xml"="8/17/2018 8:57 AM, 68 bytes, A
Adds the file vars.res"="8/17/2018 8:57 AM, 33440 bytes, A
Adds the folder C:\ProgramData\Restoro\Temp\20180817_0857
Adds the file ImageArray.ini"="8/17/2018 8:57 AM, 239328 bytes, A
Adds the folder C:\ProgramData\Restoro\Temp\20180817_0857\DownloaderTemp
In the existing folder C:\Users\Public\Desktop
Adds the file Restoro.lnk"="8/17/2018 8:56 AM, 1668 bytes, A
In the existing folder C:\Windows
Adds the file restoro.ini"="8/17/2018 8:57 AM, 150 bytes, A
Registry details [View: All details] (Selection)
------------------------------------------------
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AE198C69-7358-4856-9029-F4C0FAD524C1}\InprocServer32]
"(Default)"="REG_SZ", "C:\Program Files\Restoro\ax.dll"
"ThreadingModel"="REG_SZ", "Apartment"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AE198C69-7358-4856-9029-F4C0FAD524C1}\TypeLib]
"(Default)"="REG_SZ", "{C661BE9A-11D8-47DD-A980-6494B09F3AF3}"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{BA827421-E282-479E-AE60-34796877B8AE}]
"(Default)"="REG_SZ", "Restoro Class"
"AppID"="REG_SZ", "{9CD2C2AE-A4C8-4DFA-863E-609979849E3A}"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Restoro]
"camp"="REG_SZ", "referrer-with-no-se"
"DisplayIcon"="REG_SZ", "C:\Program Files\Restoro\Restoro_uninstall.ico"
"DisplayName"="REG_SZ", "Restoro"
"DisplayVersion"="REG_SZ", "2.0.0.4"
"DownloaderVersion"="REG_SZ", "2.0.0.1"
"InstallFile"="REG_SZ", "C:\Program Files\Restoro\RestoroMain.exe"
"InstallLocation"="REG_SZ", "C:\Program Files\Restoro"
"Publisher"="REG_SZ", "Restoro"
"tid"="REG_SZ", "5417992874"
"trac"="REG_SZ", "direct"
"UninstallString"="REG_SZ", "C:\Program Files\Restoro\uninst.exe"
"URLInfoAbout"="REG_SZ", "http://www.restoro.com"
"VersionMajor"="REG_DWORD", 2
"VersionMinor"="REG_DWORD", 4
[HKEY_LOCAL_MACHINE\SOFTWARE\Restoro]
"Installer Language"="REG_SZ", "1033"
[HKEY_LOCAL_MACHINE\SOFTWARE\Restoro\RestoroActiveProtection]
"LogsDir"="REG_SZ", "C:\ProgramData\Restoro\bin\results"
"RestoroLocation"="REG_SZ", "C:\Program Files\Restoro\Restoro.exe"
"SessionID"="REG_SZ", "86E24423-5711-2747-923C-315FC585C98E"
"SettingsPath"="REG_SZ", "C:\ProgramData\Restoro\bin\conf.res"
"Version"="REG_SZ", "3.0.0.1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Restoro\RestoroActiveProtection\Cache]
"cmp_1"="REG_SZ", "referrer-with-no-se"
"tid_1"="REG_SZ", "5417992874"
"trk_1"="REG_SZ", "direct"
[HKEY_LOCAL_MACHINE\SOFTWARE\Restoro\RestoroActiveProtection\Service]
"active_t"="REG_SZ", "1534575491"
"dmnSet"="REG_SZ", "yes"
"extSet"="REG_SZ", "yes"
"initial-install-date"="REG_SZ", "1534489027"
"install-date"="REG_SZ", "1534489027"
"pmSet"="REG_SZ", "yes"
"RealTimeSet"="REG_SZ", "1534575429"
"RealTimeStart"="REG_SZ", "1"
"RecheckNotify"="REG_SZ", "1566025026"
"RegCheck"="REG_SZ", "valid"
"request-id"="REG_SZ", "9"
"SendTimeAfterInstall"="REG_SZ", "1534499826"
"UrlSet"="REG_SZ", "1534575426"
"VerUpSet"="REG_SZ", "1534575426"
[HKEY_LOCAL_MACHINE\SOFTWARE\Restoro\RestoroActiveProtection\Service\General]
"bHis"="REG_SZ", ""
"eLst"="REG_SZ", ""
"install-end"="REG_SZ", ""
"install-start"="REG_SZ", ""
"pail"="REG_SZ", ""
"pLst"="REG_SZ", ""
"pmLst"="REG_SZ", ""
"products"="REG_SZ", ""
"uhis"="REG_SZ", ""
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager]
"BootExecute
REG_MULTI_SZ, "autocheck autochk * " ==> REG_MULTI_SZ, "autocheck autochk * "
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\RestoroActiveProtection]
"DisplayName"="REG_SZ", "Restoro Active Protection"
"ErrorControl"="REG_DWORD", 1
"ImagePath"="REG_EXPAND_SZ, ""C:\Program Files\Restoro\bin\RestoroProtection.exe""
"ObjectName"="REG_SZ", "LocalSystem"
"Start"="REG_DWORD", 2
"Type"="REG_DWORD", 16
[HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications\Restoro\Recent File List]
[HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications\Restoro\Settings]
[HKEY_CURRENT_USER\Software\Restoro\Restoro\Scan Results]
"QuickScanDone"="REG_SZ", ""
[HKEY_CURRENT_USER\Software\Restoro\Restoro Key]
"QuitMessage"="REG_SZ", " "
"WarningMessage"="REG_SZ", "FLOCK"
Malwarebytes log:Malwarebytes
www.malwarebytes.com
-Log Details-
Scan Date: 8/17/18
Scan Time: 9:12 AM
Log File: f8554257-a1ec-11e8-9987-00ffdcc6fdfc.json
Administrator: Yes
-Software Information-
Version: 3.5.1.2522
Components Version: 1.0.391
Update Package Version: 1.0.6383
License: Premium
-System Information-
OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: {computername}\{username}
-Scan Summary-
Scan Type: Threat Scan
Scan Initiated By: Manual
Result: Completed
Objects Scanned: 251266
Threats Detected: 109
Threats Quarantined: 109
Time Elapsed: 3 min, 20 sec
-Scan Options-
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Enabled
Heuristics: Enabled
PUP: Detect
PUM: Detect
-Scan Details-
Process: 3
PUP.Optional.Restoro, C:\PROGRAM FILES\RESTORO\BIN\RESTOROPROTECTION.EXE, Quarantined, [577], [551613],1.0.6383
PUP.Optional.Restoro, C:\Program Files\Restoro\bin\RestoroService.exe, Quarantined, [577], [551606],1.0.6383
PUP.Optional.Restoro, C:\Program Files\Restoro\RestoroMain.exe, Quarantined, [577], [551606],1.0.6383
Module: 5
PUP.Optional.Restoro, C:\PROGRAM FILES\RESTORO\AX.DLL, Quarantined, [577], [551619],1.0.6383
PUP.Optional.Restoro, C:\PROGRAM FILES\RESTORO\BIN\RESTOROPROTECTION.EXE, Quarantined, [577], [551613],1.0.6383
PUP.Optional.Restoro, C:\Program Files\Restoro\bin\RestoroService.exe, Quarantined, [577], [551606],1.0.6383
PUP.Optional.Restoro, C:\Program Files\Restoro\engine.dll, Quarantined, [577], [551606],1.0.6383
PUP.Optional.Restoro, C:\Program Files\Restoro\RestoroMain.exe, Quarantined, [577], [551606],1.0.6383
Registry Key: 22
PUP.Optional.Restoro, HKCU\SOFTWARE\Local AppWizard-Generated Applications\Restoro, Quarantined, [577], [551612],1.0.6383
PUP.Optional.Restoro, HKLM\SOFTWARE\CLASSES\CLSID\{BA827421-E282-479E-AE60-34796877B8AE}, Quarantined, [577], [551619],1.0.6383
PUP.Optional.Restoro, HKLM\SOFTWARE\CLASSES\CLSID\{AE198C69-7358-4856-9029-F4C0FAD524C1}, Quarantined, [577], [551619],1.0.6383
PUP.Optional.Restoro, HKLM\SOFTWARE\CLASSES\TYPELIB\{C661BE9A-11D8-47DD-A980-6494B09F3AF3}, Quarantined, [577], [551619],1.0.6383
PUP.Optional.Restoro, HKLM\SOFTWARE\CLASSES\INTERFACE\{9BB31AD8-5DB2-459E-A901-DEA536F23BA4}, Quarantined, [577], [551619],1.0.6383
PUP.Optional.Restoro, HKLM\SOFTWARE\CLASSES\INTERFACE\{BD51A48E-EB5F-4454-8774-EF962DF64546}, Quarantined, [577], [551619],1.0.6383
PUP.Optional.Restoro, HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{9BB31AD8-5DB2-459E-A901-DEA536F23BA4}, Quarantined, [577], [551619],1.0.6383
PUP.Optional.Restoro, HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{BD51A48E-EB5F-4454-8774-EF962DF64546}, Quarantined, [577], [551619],1.0.6383
PUP.Optional.Restoro, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{9BB31AD8-5DB2-459E-A901-DEA536F23BA4}, Quarantined, [577], [551619],1.0.6383
PUP.Optional.Restoro, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{BD51A48E-EB5F-4454-8774-EF962DF64546}, Quarantined, [577], [551619],1.0.6383
PUP.Optional.Restoro, HKLM\SOFTWARE\WOW6432NODE\CLASSES\TYPELIB\{C661BE9A-11D8-47DD-A980-6494B09F3AF3}, Quarantined, [577], [551619],1.0.6383
PUP.Optional.Restoro, HKLM\SOFTWARE\CLASSES\WOW6432NODE\TYPELIB\{C661BE9A-11D8-47DD-A980-6494B09F3AF3}, Quarantined, [577], [551619],1.0.6383
PUP.Optional.Restoro, HKLM\SOFTWARE\CLASSES\CLSID\{AE198C69-7358-4856-9029-F4C0FAD524C1}\InprocServer32, Quarantined, [577], [551619],1.0.6383
PUP.Optional.Restoro, HKLM\SOFTWARE\CLASSES\CLSID\{BA827421-E282-479E-AE60-34796877B8AE}\InprocServer32, Quarantined, [577], [551619],1.0.6383
PUP.Optional.Restoro, HKLM\SOFTWARE\CLASSES\Restoro.Engine.1, Quarantined, [577], [551619],1.0.6383
PUP.Optional.Restoro, HKLM\SOFTWARE\CLASSES\Restoro.Engine, Quarantined, [577], [551619],1.0.6383
PUP.Optional.Restoro, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\Restoro, Quarantined, [577], [551615],1.0.6383
PUP.Optional.Restoro, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\RestoroActiveProtection, Quarantined, [577], [551613],1.0.6383
PUP.Optional.Restoro, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\Restoro.exe, Quarantined, [577], [551617],1.0.6383
PUP.Optional.Restoro, HKCU\SOFTWARE\Restoro, Quarantined, [577], [551610],1.0.6383
PUP.Optional.Restoro, HKLM\SOFTWARE\Restoro, Quarantined, [577], [551614],1.0.6383
PUP.Optional.Restoro, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\Restoro.exe, Quarantined, [577], [551617],1.0.6383
Registry Value: 0
(No malicious items detected)
Registry Data: 0
(No malicious items detected)
Data Stream: 0
(No malicious items detected)
Folder: 13
PUP.Optional.Restoro, C:\PROGRAMDATA\MICROSOFT\WINDOWS\START MENU\PROGRAMS\RESTORO, Quarantined, [577], [551604],1.0.6383
PUP.Optional.Restoro, C:\ProgramData\Restoro\Results\EXE2.0.0.4\RUN20180817_0857, Quarantined, [577], [551605],1.0.6383
PUP.Optional.Restoro, C:\ProgramData\Restoro\Temp\20180817_0857\DownloaderTemp, Quarantined, [577], [551605],1.0.6383
PUP.Optional.Restoro, C:\ProgramData\Restoro\Results\EXE2.0.0.4, Quarantined, [577], [551605],1.0.6383
PUP.Optional.Restoro, C:\ProgramData\Restoro\Temp\20180817_0857, Quarantined, [577], [551605],1.0.6383
PUP.Optional.Restoro, C:\ProgramData\Restoro\bin\Results, Quarantined, [577], [551605],1.0.6383
PUP.Optional.Restoro, C:\ProgramData\Restoro\Results, Quarantined, [577], [551605],1.0.6383
PUP.Optional.Restoro, C:\ProgramData\Restoro\Temp, Quarantined, [577], [551605],1.0.6383
PUP.Optional.Restoro, C:\ProgramData\Restoro\bin, Quarantined, [577], [551605],1.0.6383
PUP.Optional.Restoro, C:\ProgramData\Restoro\AV, Quarantined, [577], [551605],1.0.6383
PUP.Optional.Restoro, C:\PROGRAMDATA\RESTORO, Quarantined, [577], [551605],1.0.6383
PUP.Optional.Restoro, C:\Program Files\Restoro\bin, Quarantined, [577], [551606],1.0.6383
PUP.Optional.Restoro, C:\PROGRAM FILES\RESTORO, Quarantined, [577], [551606],1.0.6383
File: 66
PUP.Optional.Restoro, C:\PROGRAM FILES\RESTORO\AX.DLL, Quarantined, [577], [551619],1.0.6383
PUP.Optional.Restoro, C:\PROGRAM FILES\RESTORO\BIN\RESTOROPROTECTION.EXE, Quarantined, [577], [551613],1.0.6383
PUP.Optional.Restoro, C:\USERS\PUBLIC\DESKTOP\RESTORO.LNK, Quarantined, [577], [551608],1.0.6383
PUP.Optional.Restoro, C:\WINDOWS\RESTORO.INI, Quarantined, [577], [551609],1.0.6383
PUP.Optional.Restoro, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Restoro\Help & Support.lnk, Quarantined, [577], [551604],1.0.6383
PUP.Optional.Restoro, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Restoro\Privacy Policy.lnk, Quarantined, [577], [551604],1.0.6383
PUP.Optional.Restoro, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Restoro\Restoro.lnk, Quarantined, [577], [551604],1.0.6383
PUP.Optional.Restoro, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Restoro\Run in safe mode.lnk, Quarantined, [577], [551604],1.0.6383
PUP.Optional.Restoro, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Restoro\Terms of Use.lnk, Quarantined, [577], [551604],1.0.6383
PUP.Optional.Restoro, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Restoro\Uninstall Instructions.lnk, Quarantined, [577], [551604],1.0.6383
PUP.Optional.Restoro, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Restoro\Uninstall.lnk, Quarantined, [577], [551604],1.0.6383
PUP.Optional.Restoro, C:\ProgramData\Restoro\AV\avupdate.exe, Quarantined, [577], [551605],1.0.6383
PUP.Optional.Restoro, C:\ProgramData\Restoro\AV\avupdate_msg.avr, Quarantined, [577], [551605],1.0.6383
PUP.Optional.Restoro, C:\ProgramData\Restoro\AV\cacert.crt, Quarantined, [577], [551605],1.0.6383
PUP.Optional.Restoro, C:\ProgramData\Restoro\AV\HBEDV.KEY, Quarantined, [577], [551605],1.0.6383
PUP.Optional.Restoro, C:\ProgramData\Restoro\AV\msvcr120.dll, Quarantined, [577], [551605],1.0.6383
PUP.Optional.Restoro, C:\ProgramData\Restoro\AV\productname.dat, Quarantined, [577], [551605],1.0.6383
PUP.Optional.Restoro, C:\ProgramData\Restoro\AV\savapi.exe, Quarantined, [577], [551605],1.0.6383
PUP.Optional.Restoro, C:\ProgramData\Restoro\AV\savapi_restart.exe, Quarantined, [577], [551605],1.0.6383
PUP.Optional.Restoro, C:\ProgramData\Restoro\AV\savapi_stub.exe, Quarantined, [577], [551605],1.0.6383
PUP.Optional.Restoro, C:\ProgramData\Restoro\AV\xbvRei.vdf, Quarantined, [577], [551605],1.0.6383
PUP.Optional.Restoro, C:\ProgramData\Restoro\bin\Results\restoro-service-setup.log, Quarantined, [577], [551605],1.0.6383
PUP.Optional.Restoro, C:\ProgramData\Restoro\bin\Results\restoro-service-updater.log, Quarantined, [577], [551605],1.0.6383
PUP.Optional.Restoro, C:\ProgramData\Restoro\bin\active_protection.txt, Quarantined, [577], [551605],1.0.6383
PUP.Optional.Restoro, C:\ProgramData\Restoro\bin\conf.res, Quarantined, [577], [551605],1.0.6383
PUP.Optional.Restoro, C:\ProgramData\Restoro\bin\urls.set, Quarantined, [577], [551605],1.0.6383
PUP.Optional.Restoro, C:\ProgramData\Restoro\Results\EXE2.0.0.4\RUN20180817_0857\installed.rec, Quarantined, [577], [551605],1.0.6383
PUP.Optional.Restoro, C:\ProgramData\Restoro\Results\EXE2.0.0.4\RUN20180817_0857\junk_results.xml, Quarantined, [577], [551605],1.0.6383
PUP.Optional.Restoro, C:\ProgramData\Restoro\Results\EXE2.0.0.4\RUN20180817_0857\out.log, Quarantined, [577], [551605],1.0.6383
PUP.Optional.Restoro, C:\ProgramData\Restoro\Results\EXE2.0.0.4\RUN20180817_0857\RegistryScanRes.xml, Quarantined, [577], [551605],1.0.6383
PUP.Optional.Restoro, C:\ProgramData\Restoro\Results\EXE2.0.0.4\RUN20180817_0857\restoro.2.log, Quarantined, [577], [551605],1.0.6383
PUP.Optional.Restoro, C:\ProgramData\Restoro\Results\EXE2.0.0.4\RUN20180817_0857\restoro.log, Quarantined, [577], [551605],1.0.6383
PUP.Optional.Restoro, C:\ProgramData\Restoro\Results\EXE2.0.0.4\RUN20180817_0857\StabilityScanRes.xml, Quarantined, [577], [551605],1.0.6383
PUP.Optional.Restoro, C:\ProgramData\Restoro\Results\EXE2.0.0.4\RUN20180817_0857\vars.res, Quarantined, [577], [551605],1.0.6383
PUP.Optional.Restoro, C:\ProgramData\Restoro\Temp\20180817_0857\ImageArray.ini, Quarantined, [577], [551605],1.0.6383
PUP.Optional.Restoro, C:\ProgramData\Restoro\conf.res, Quarantined, [577], [551605],1.0.6383
PUP.Optional.Restoro, C:\ProgramData\Restoro\res-v01.ini, Quarantined, [577], [551605],1.0.6383
PUP.Optional.Restoro, C:\ProgramData\Restoro\restoro.ext, Quarantined, [577], [551605],1.0.6383
PUP.Optional.Restoro, C:\ProgramData\Restoro\TechSupportApp.ini, Quarantined, [577], [551605],1.0.6383
PUP.Optional.Restoro, C:\Program Files\Restoro\bin\RestoroScanner.exe, Quarantined, [577], [551606],1.0.6383
PUP.Optional.Restoro, C:\Program Files\Restoro\bin\RestoroService.exe, Quarantined, [577], [551606],1.0.6383
PUP.Optional.Restoro, C:\Program Files\Restoro\bin\RestoroUI.exe, Quarantined, [577], [551606],1.0.6383
PUP.Optional.Restoro, C:\Program Files\Restoro\bin\RestoroUpdater.exe, Quarantined, [577], [551606],1.0.6383
PUP.Optional.Restoro, C:\Program Files\Restoro\ax.lza, Quarantined, [577], [551606],1.0.6383
PUP.Optional.Restoro, C:\Program Files\Restoro\engine.dll, Quarantined, [577], [551606],1.0.6383
PUP.Optional.Restoro, C:\Program Files\Restoro\engine.lza, Quarantined, [577], [551606],1.0.6383
PUP.Optional.Restoro, C:\Program Files\Restoro\LZMA.EXE, Quarantined, [577], [551606],1.0.6383
PUP.Optional.Restoro, C:\Program Files\Restoro\msvcr120.dll, Quarantined, [577], [551606],1.0.6383
PUP.Optional.Restoro, C:\Program Files\Restoro\Restoro Help & Support.url, Quarantined, [577], [551606],1.0.6383
PUP.Optional.Restoro, C:\Program Files\Restoro\Restoro Privacy Policy.url, Quarantined, [577], [551606],1.0.6383
PUP.Optional.Restoro, C:\Program Files\Restoro\Restoro Terms of Use.url, Quarantined, [577], [551606],1.0.6383
PUP.Optional.Restoro, C:\Program Files\Restoro\Restoro Uninstall Instructions.url, Quarantined, [577], [551606],1.0.6383
PUP.Optional.Restoro, C:\Program Files\Restoro\Restoro.exe, Quarantined, [577], [551606],1.0.6383
PUP.Optional.Restoro, C:\Program Files\Restoro\RestoroAM.exe, Quarantined, [577], [551606],1.0.6383
PUP.Optional.Restoro, C:\Program Files\Restoro\Restoroicon.ico, Quarantined, [577], [551606],1.0.6383
PUP.Optional.Restoro, C:\Program Files\Restoro\RestoroMain.exe, Quarantined, [577], [551606],1.0.6383
PUP.Optional.Restoro, C:\Program Files\Restoro\RestoroSafeMode.exe, Quarantined, [577], [551606],1.0.6383
PUP.Optional.Restoro, C:\Program Files\Restoro\Restoro_SafeMode.ico, Quarantined, [577], [551606],1.0.6383
PUP.Optional.Restoro, C:\Program Files\Restoro\Restoro_uninstall.ico, Quarantined, [577], [551606],1.0.6383
PUP.Optional.Restoro, C:\Program Files\Restoro\Restoro_website.ico, Quarantined, [577], [551606],1.0.6383
PUP.Optional.Restoro, C:\Program Files\Restoro\savapi.dll, Quarantined, [577], [551606],1.0.6383
PUP.Optional.Restoro, C:\Program Files\Restoro\TechSupportApp.exe, Quarantined, [577], [551606],1.0.6383
PUP.Optional.Restoro, C:\Program Files\Restoro\uninst.exe, Quarantined, [577], [551606],1.0.6383
PUP.Optional.Restoro, C:\DOCUMENTS AND SETTINGS\PUBLIC\Desktop\Restoro.lnk, Quarantined, [577], [551606],1.0.6383
PUP.Optional.Restoro, C:\USERS\{username}\DESKTOP\RESTORO.EXE, Quarantined, [577], [551611],1.0.6383
PUP.Optional.Restoro, C:\USERS\{username}\APPDATA\LOCAL\TEMP\RESTOROSETUP.EXE, Quarantined, [577], [551611],1.0.6383
Physical Sector: 0
(No malicious items detected)
WMI: 0
(No malicious items detected)
(end)As mentioned before the full version of Malwarebytes could have protected your computer against this threat.We use different ways of protecting your computer(s):
- Dynamically Blocks Malware Sites & Servers
- Malware Execution Prevention
Back to top
Sign In
Create Account
