suspicious double extension

Discussion in 'Trojan Defence Suite' started by Saint Satin Stain, Dec 18, 2004.

Thread Status:
Not open for further replies.
  1. Saint Satin Stain

    Saint Satin Stain Registered Member

    Joined:
    Feb 16, 2004
    Posts:
    222
    Location:
    Huntsville, AL and Greenwich Village, NYC
    TDS-3 found this double extension pcdoc.bat.pif. what is it? Is it a legit windows xp pro file?
     
  2. bloodscourge

    bloodscourge Registered Member

    Joined:
    Jul 3, 2004
    Posts:
    372
    Location:
    France
    Hi,

    Double extension is often associated with vicious email attachments : it's due to the masking of known file extension under windows (thus outlook...). It makes you think that a file is legitimate but it's not (for example : if you create a file named image.jpg.exe, if extension masking is enabled you'll only see image.jpg, hence thinking it's only a image file => you can imagine when you receive a malicious pif/bat/exe/com file disguised as a innocent picture or animation :rolleyes:).

    But double extension can be inofensive (involved in version numbering of executable... etc). In your case, I think you should delete this one, a nasty or crappy one... but wait for others' opinion ;)
     
  3. dvk01

    dvk01 Global Moderator

    Joined:
    Oct 9, 2003
    Posts:
    3,131
    Location:
    Loughton, Essex. UK
    That one generally is OK

    The pcdoc.bat.pif is a Shortcut to MSDOS Program
    PC Doctor On Call and when double clicked just starts an annoying siren and nothing else happens

    It's a useless little application so I would delete it anway

    BUT double extensions can be dangerous that's why TDS flags them
     
Thread Status:
Not open for further replies.