Riskware/InstallMate

description-logoAnalysis


Riskware/InstallMate is a generic detection for a type of grayware that arrives as an application installation package and might download and install unwanted software.
Below are typical actions done by this type of application:

  • It attempts to download and install other potentially unwanted software.
  • Web browser toolbars may also be installed by default.
  • There may be no 'Cancel' or 'Exit' button on the installation interface.
  • It may create the following files:
    • undefinedTEMPundefined\tsu{random}.dll
    • undefinedAppDataundefined\InstallMate\{Random}\cfg\1.ini


recommended-action-logoRecommended Action

FortiGate Systems

  • Check the main screen using the web interface for your FortiGate unit to ensure that the latest AV/NIDS database has been downloaded and installed on your system - if required, enable the "Allow Push Update" option.

FortiClient Systems
  • Quarantine/delete files that are detected and replace infected files with clean backup copies.

Telemetry logoTelemetry

Detection Availability

FortiGate
Extended
FortiClient
FortiMail
FortiSandbox
FortiWeb
Web Application Firewall
FortiIsolator
FortiDeceptor
FortiEDR

Version Updates

Date Version Detail
2024-03-28 92.02864
2024-03-27 92.02834
2024-03-27 92.02821
2024-03-25 92.02787
2024-03-25 92.02762
2024-03-24 92.02737
2024-03-23 92.02725
2024-03-23 92.02721
2024-03-23 92.02703
2024-03-22 92.02691