VIRUS: Double File Extension

This anomaly triggers when it detects an e-mail attachments that contains two file extensions. Attackers or viruses can send e-mail attachments that use two file extensions to disguise the actual file name and trick users into opening a malicious attachment.

Extended Description

Files with double extensions could contain virus or worm code, and are easier to fool users into opening than files with one normal executable extension.

References

URL: http://www.cknow.com/vtutor/FileExtensions.html http://antivirus.about.com/library/blext.htm

Short Name

VIRUS:SMTP:DOUBLE-EXTENSION

Severity

Major

Recommended

True

Recommended Action

Drop

VIRUS: Double File Extension

Extended Description

References

Found a potential security threat?