Download TrojanHunter Now
Free 30-day trial!
Latest TrojanHunter Version:
TrojanHunter 5.0
Order Now
License file delivered within minutes.
Welcome, Guest. Please Login or Register.
Jan 8th, 2009, 8:28am
   Mischel Internet Security Forum
   TrojanHunter
   TrojanHunter Scanner (Moderators: Helena, Gavin_Coe, Magnus)
   Double extensions - should I worry?		 « Previous topic | Next topic »
Pages: 1  Reply Reply  Notify of replies Notify of replies   Send Topic Send Topic   Print Print
   Author  Topic: Double extensions - should I worry?  (Read 336 times)
xylophone
Newbie
*





   


Posts: 19
Double extensions - should I worry?
« on: Nov 18th, 2007, 3:27am »		 Quote Quote  Modify Modify
I run TH version 4.6 Build 430 on a XP machine.  Today I got the following entries in the results of a full scan.  Not had these before.  Something I should worry about?  If so, what can I do about them?  Am now running a full NAV scan, which will take some hours.  Thanks.
 
Warning: Executable file with double extensions found: C:\WINDOWS\assembly\GAC\Microsoft.VisualBasic.Vsa\7.0.5000.0__b03f5f7f11 d50a3a\Microsoft.VisualBasic.Vsa.dll
Warning: Executable file with double extensions found: C:\WINDOWS\assembly\GAC\Microsoft.Vsa\7.0.5000.0__b03f5f7f11d50a3a\Micro soft.Vsa.dll
Warning: Executable file with double extensions found: C:\WINDOWS\assembly\GAC\System.Web\1.0.5000.0__b03f5f7f11d50a3a\System.W eb.dll
Warning: Executable file with double extensions found: C:\WINDOWS\assembly\GAC\System.Xml\1.0.5000.0__b77a5c561934e089\System.X ML.dll
Warning: Executable file with double extensions found: C:\WINDOWS\assembly\GAC_32\System.Web\2.0.0.0__b03f5f7f11d50a3a\System.W eb.dll
Warning: Executable file with double extensions found: C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic.Vsa\8.0.0.0__b03f5f7f 11d50a3a\Microsoft.VisualBasic.Vsa.dll
Warning: Executable file with double extensions found: C:\WINDOWS\assembly\GAC_MSIL\Microsoft.Vsa\8.0.0.0__b03f5f7f11d50a3a\Mic rosoft.Vsa.dll
Warning: Executable file with double extensions found: C:\WINDOWS\assembly\GAC_MSIL\System.Xml\2.0.0.0__b77a5c561934e089\System .XML.dll
Warning: Executable file with double extensions found: C:\WINDOWS\assembly\NativeImages1_v1.1.4322\System.Xml\1.0.5000.0__b77a5 c561934e089_394c2fbb\System.Xml.dll
Warning: Executable file with double extensions found: C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Microsoft.VisualBasic.Vsa.d ll
Warning: Executable file with double extensions found: C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Microsoft.Vsa.dll
Warning: Executable file with double extensions found: C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.Web.dll
Warning: Executable file with double extensions found: C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.XML.dll
Warning: Executable file with double extensions found: C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.VisualBasic.Vsa. dll
Warning: Executable file with double extensions found: C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.Vsa.dll
Warning: Executable file with double extensions found: C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Web.dll
Warning: Executable file with double extensions found: C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.XML.dll
No trojan files found
IP Logged
siliconman01
Global Moderator
*****



Trojans! Chew 'em Up, Spit 'em Out...

   


Gender: male
 Posts: 5960
Re: Double extensions - should I worry?
« Reply #1 on: Nov 18th, 2007, 3:51am »		 Quote Quote  Modify Modify
Here is a write up concerning double extensions.  
 
http://www.misec.net/forum/board/FAQ/1139255660
 
The ones in your post are all okay.  You can avoid these being logged during a scan by:
 
-  Open TH scanner GUI
-  Click on the Options icon on the left icon bar
-  Uncheck the very last option "Log executable files with double extensions"
 
It will still scan them for malicious content.  
 
TrojanHunter V5.0.962 is available for upgrading.  It has many enhancements over V4.6.
IP Logged
______
TrojanHunter V5.0.962...No. 1 AT in my Book and on my Box!
xylophone
Newbie
*





   


Posts: 19
Re: Double extensions - should I worry?
« Reply #2 on: Nov 18th, 2007, 5:12am »		 Quote Quote  Modify Modify
Many thanks for this prompt reply.  I had found the relevant tick box.  Having read the article you referred to, I'm still not clear why my entries are OK, as you say.  Can you tell me why - in simple language! Smiley
IP Logged
siliconman01
Global Moderator
*****



Trojans! Chew 'em Up, Spit 'em Out...

   


Gender: male
 Posts: 5960
Re: Double extensions - should I worry?
« Reply #3 on: Nov 18th, 2007, 5:40am »		 Quote Quote  Modify Modify
Well, they are all Microsoft components that are part of various known Microsoft modules.  This is a typical situation where the Microsoft software developers cloud the security issue by naming their components with two or more periods in the name of component.  The link I provided it explains it more.  
 
If you do a Google search for, say,  System.XML.dll you will see that it is a valid MS element.
« Last Edit: Nov 18th, 2007, 5:42am by siliconman01 » IP Logged
______
TrojanHunter V5.0.962...No. 1 AT in my Book and on my Box!
xylophone
Newbie
*





   


Posts: 19
Re: Double extensions - should I worry?
« Reply #4 on: Nov 18th, 2007, 6:18am »		 Quote Quote  Modify Modify
This is what I needed.  Many thanks
IP Logged
Pages: 1  Reply Reply  Notify of replies Notify of replies   Send Topic Send Topic   Print Print

« Previous topic | Next topic »
Search
Members
Login
Register