Restoro Cyprus Limited and Reimage Cyprus Limited agreed to pay $26 million to settle Federal Trade Commission (FTC) charges that they used deceptive marketing and telemarketing to sell computer-repair services. The FTC announced the civil settlement on March 14, 2024. “Fined” is common shorthand, but the companies settled the allegations; the case was not a criminal conviction or a trial verdict. Consumers who paid may also want to check the FTC’s current refund information.
What the FTC alleged Restoro and Reimage did
The FTC said online ads and pop-ups imitated Microsoft Windows warnings, claiming that a computer had viruses, malware, or serious performance problems. They urged users to scan their devices to prevent further damage. The allegations describe the companies’ marketing and sales practices; they do not establish that every customer saw the same alert or experience. The FTC’s settlement announcement and its case file identify the defendants as Cyprus-based Restoro Cyprus Limited and Reimage Cyprus Limited.
From a scan to a higher-priced service
- A user encountered a frightening ad or Windows-style alert and was encouraged to scan the computer.
- The FTC alleged that scans reported numerous problems, including on computers without security or performance issues.
- The user was prompted to buy software, which the FTC said generally cost about $27 to $58.
- After purchase, the user was given a phone number to activate the software. The FTC alleged that telemarketers then said the software alone could not resolve the supposed problems.
- The consumer could be offered remote help or a technician plan costing hundreds of dollars more. Reporting based on the complaint described Silver, Gold, and Platinum packages priced at approximately $199.99, $299.99, and $499.99; those figures should not be treated as a universal price list. BleepingComputer’s report discusses the complaint’s allegations.
What the FTC said its tests found
According to the FTC, investigators tested Restoro in May and June 2022 and Reimage in July and August 2022. The test computers had antivirus software and no performance or security issues, yet the scans reportedly listed hundreds of supposed problems, such as privacy issues, junk files, crashed programs, and broken registry entries. These are findings and allegations described by the FTC, not a claim that every scan or every product use produced the same result. The FTC’s account of the testing is in its announcement; additional test-period detail appears in BleepingComputer’s coverage based on the complaint.
Why Event Viewer and VirusTotal displays can be misleading
The FTC complaint alleged that telemarketers used Windows Event Viewer entries to suggest that consumers had malware or serious computer problems. Event Viewer records errors, warnings, and informational events; an entry alone does not prove an infection or urgent failure. Some events can matter, but a technician needs to interpret them in context, consider symptoms, and use appropriate diagnostics. A long list without an explanation of severity or relevance can give a distorted impression.
#1 Best Overall
The complaint also reportedly alleged that telemarketers displayed VirusTotal results as proof that a remotely accessed computer was infected. VirusTotal aggregates results from multiple security engines, but a result relates to a particular file, URL, or other indicator—not automatically to the entire computer. The object tested, whether it was actually on the computer, and the possibility of a false positive or reputation warning all matter. The allegation concerns how results were presented, not wrongdoing by VirusTotal. BleepingComputer’s account of the complaint describes these alleged practices.
What the $26 million settlement means
The FTC filed a civil complaint in the U.S. District Court for the District of Columbia alleging violations of the FTC Act and the Telemarketing Sales Rule. Under a stipulated settlement, the companies agreed to monetary relief and restrictions on future marketing. The order prohibits misrepresentations about computer security, performance, or other material problems, and bars deceptive telemarketing. The $26 million was settlement-related relief intended for consumer redress—not a conventional criminal fine imposed after a conviction. The companies’ agreement does not mean a court or jury found every allegation about every customer interaction true. See the FTC case file for the complaint and order.
Restoro-Reimage refunds: check the FTC’s current page
In March 2025, the FTC said it sent more than $25.5 million in refunds through 736,375 PayPal payments to consumers who paid for the companies’ computer-repair services. Eligible consumers were contacted by email, and the payments had to be redeemed within 30 days. The FTC said Rust Consulting administered the refunds and listed 1-844-590-1102 as its phone number. Read the FTC’s March 2025 announcement.
In March 2026, the FTC said it was sending checks to people who did not accept their PayPal payments; recipients were told to cash checks within 90 days. That does not establish that a new claim period is open now. Check the FTC’s Restoro-Reimage refund page for current status and instructions. The FTC says it will not charge a fee or ask for account information to issue a refund. Do not rely on a link or phone number in an unexpected message; go to the FTC site yourself.
Rank #3
How to recognize and respond to a tech-support scare
Warning signs
- A browser pop-up claims to be an official Windows or Microsoft warning and tells you to call a number immediately.
- The message uses sirens, countdowns, full-screen effects, or threats of data loss to rush you.
- A scan reports an implausibly large number of problems without showing verifiable evidence.
- A salesperson insists on remote access before clearly explaining the issue, or treats ordinary Event Viewer entries as proof of infection.
- A low-cost scan or software purchase is followed by pressure to buy a service costing hundreds of dollars.
- The caller discourages you from asking Microsoft, your device maker, a trusted technician, or someone you trust for a second opinion.
- You are asked to pay by gift card, cryptocurrency, wire transfer, or another unusual method.
A genuine security alert can coexist with a deceptive browser page. Verify a possible threat through the security app already installed on your device or another product obtained directly from its official site—not through a number in the pop-up. A slow computer can also have causes such as low storage, failing hardware, updates, browser extensions, overheating, or age. For more guidance, see the FTC’s advice on spotting, avoiding, and reporting tech-support scams.
If a pop-up appears
- Do not call its number or grant remote access.
- Close the browser tab or force-quit the browser. If it will not close, restart the device.
- Run a scan with the operating system’s built-in security tools or a reputable product downloaded directly from its official website.
- Review bank and card statements for unexpected or recurring charges, and contact your payment provider if you see a charge you do not recognize or want to dispute.
- Report the incident to the FTC using its official reporting guidance.
A browser scare page by itself does not prove the computer is infected, and seeing one does not prove that personal data was stolen. If you have other signs of a problem, seek a diagnosis independently rather than buying help through the alert.
If you granted remote access or shared information
- Disconnect the affected computer from the internet and remove unfamiliar remote-access software. Removing one tool does not prove that all changes made during the session have been undone.
- From a clean device, change important passwords, especially for email, banking, shopping, and any password manager.
- Contact your card issuer or payment provider about charges or payment details you shared.
- Check for unfamiliar programs, browser extensions, startup items, or user accounts, and run a reputable security scan.
- Keep receipts, emails, phone numbers, chat logs, and screenshots. Report the incident to the FTC and consider contacting local law enforcement if you lost money or exposed identity information.
Choosing legitimate computer help
A trustworthy provider should identify the company and technician, explain the suspected problem before requesting remote access, give you a written price and scope of work, and allow time for a second opinion. Be wary of anyone who impersonates Microsoft or another trusted brand, treats every warning or registry entry as a virus, pressures you to act immediately, or demands secrecy or unusual payment. Transparent maintenance software and security products are not automatically fraudulent; the warning sign is a sales process that manufactures urgency, misrepresents routine information, and pushes an expensive service without a clear diagnosis.
- Windows Security is built into supported Windows editions and offers baseline protection without a separate purchase in general; it is not a guarantee against every threat.
- Malwarebytes offers free scanning and paid consumer plans. Check its official page for current terms; a scan does not establish that a pop-up’s claims were accurate, and software cannot repair failing hardware.
- Microsoft Support is an official route for Microsoft-product troubleshooting. Navigate to it yourself; paid support availability can vary by product and region.
- For hardware problems, start with the device maker’s verified support site or a reputable local repair shop. Ask for a written estimate; prices vary with location, device, warranty, and repair.
A separate FTC action involving Paddle
In June 2025, the FTC announced a proposed $5 million settlement with payment processor Paddle over alleged unfair payment-processing practices, including allegations that it facilitated deceptive tech-support schemes involving Restoro-Reimage and processed automatically renewing subscriptions without adequate disclosure or consent. This is a separate matter from the $26 million Restoro-Reimage settlement and should not be added to that settlement amount. The FTC’s Paddle announcement describes that case.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
