Fiddler Ideas

The free web debugging proxy for any browser, system or platform.

SetupHelper is ranked as malicious

I was reading a malware report on the Fiddler Installer "[Sep-15-17] v4.6.20173.38786" and two things grabbed my attention. First SetupHelper is classified as malicious (Eric says that may be because it's missing the .exe extension) and second the mscorsvw process writes to an unknown file the contents MEOW followed by some indecipherable data.

  • Guest
  • Nov 20 2017
  • Under review
  • Attach files
  • Eric Lawrence commented
    20 Nov, 2017 08:58pm

     I suspect the MEOW thing is even more of a red herring.

    In COM and DCOM marshalled interfaces, called OBJREFs, always start with the byte sequence "MEOW" (4D 45 4F 57).