{"id":6314,"date":"2015-05-28T20:29:02","date_gmt":"2015-05-28T20:29:02","guid":{"rendered":"http:\/\/www.freefixer.com\/b\/?p=6314"},"modified":"2018-05-29T11:57:37","modified_gmt":"2018-05-29T11:57:37","slug":"safemode-install-fried-cookie-ltd-9-detection-rate","status":"publish","type":"post","link":"https:\/\/www.freefixer.com\/b\/safemode-install-fried-cookie-ltd-9-detection-rate\/","title":{"rendered":"Safemode Install (Fried Cookie Ltd) – 9% Detection Rate"},"content":{"rendered":"

Hi there! Just a short post on a publisher called Safemode Install (Fried Cookie Ltd)<\/strong> before going back to some coding on FreeFixer.\u00a0The file is called\u00a0chrome_setup.exe<\/strong>.<\/p>\n

\"Safemode<\/a><\/p>\n

By looking at the certificate we can see that Safemode Install (Fried Cookie Ltd) appears to be located in Tel Aviv in Israel.<\/p>\n

The issue here is that if chrome_setup.exe really was an installer for Google Chrome, it should be signed by Google Inc.<\/strong> and not by some unknown company. Here’s how the authentic Google Chrome<\/strong> looks like when you double click on it. Notice that the “Verified publisher” says “Google Inc”.
\n\"Chrome<\/a><\/p>\n

So, what’s the problem? Well, some of the anti-virus over at VirusTotal<\/a> detects the Safemode Install\u00a0file. Application.Win32.FriedCookie.CIRK, Trojan.InstallCore.844, a variant of Win32\/InstallCore.ZM potentially unwanted and PUP.Optional.InstallCore.SID.C are some of the detection names.<\/p>\n

\"Safemode<\/a><\/p>\n

Did you also find an Safemode Install (Fried Cookie Ltd)? Do you remember the download link? Please post it in the comments below and I’ll upload it to VirusTotal<\/a> to see if that one is also detected.<\/p>\n

Thanks for reading.<\/p>\n","protected":false},"excerpt":{"rendered":"

Hi there! Just a short post on a publisher called Safemode Install (Fried Cookie Ltd) before going back to some coding on FreeFixer.\u00a0The file is called\u00a0chrome_setup.exe. By looking at the certificate we can see that Safemode Install (Fried Cookie Ltd) appears to be located in Tel Aviv in Israel. The issue here is that if … Continue reading Safemode Install (Fried Cookie Ltd) – 9% Detection Rate<\/span> →<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[54],"tags":[372,104],"_links":{"self":[{"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/posts\/6314"}],"collection":[{"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/comments?post=6314"}],"version-history":[{"count":2,"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/posts\/6314\/revisions"}],"predecessor-version":[{"id":6318,"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/posts\/6314\/revisions\/6318"}],"wp:attachment":[{"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/media?parent=6314"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/categories?post=6314"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/tags?post=6314"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}