Riskware/PUP

description-logoAnalysis



This detection is for installers of applications that bundle themselves with toolbars or Browser Helper Objects (BHOs) that usually display some form of adverstisement. The detection does not indicate the presence of malware, but is used to classify software with possibly unwanted behavior that may be a potential risk to users.
Riskware applications usually affect productivity and are thus not useful in a corporate environment.
A few noticeable bundles that have been observed were made with NSIS, WiseInstaller, and SmartInstaller.
Below are screenshots of some of the installation packages:


  • Figure 1: Installation prompt example 1.


  • Figure 2: Installation prompt example 2.


  • Figure 3: Installation prompt example 3.


  • Figure 4: Installation prompt example 4.

recommended-action-logoRecommended Action

  • Make sure that your FortiGate/FortiClient system is using the latest AV database.
  • Quarantine/delete files that are detected and replace infected files with clean backup copies.

Telemetry logoTelemetry

Detection Availability

FortiGate
Extended
FortiClient
FortiMail
FortiSandbox
FortiWeb
Web Application Firewall
FortiIsolator
FortiDeceptor
FortiEDR

Version Updates

Date Version Detail
2023-12-04 91.09402
2023-12-03 91.09396
2023-12-03 91.09394
2023-12-03 91.09390
2023-12-02 91.09364
2023-12-02 91.09344
2023-12-01 91.09326
2023-12-01 91.09324
2023-12-01 91.09322
2023-12-01 91.09320