SSCP Domain 7: Malicious code -- Blocking file extensions

Domain 7 of the SSCP addresses malicious code, including viruses, worms, logic bombs and Trojan horses. This excerpt from the "Official (ISC)2 Guide to the SSCP CBK" takes a look at double file extensions and offers a list of file extensions to block to protect systems from malware. Also download the full chapter as a PDF.

Customers may not know the difference between a virus and a worm, but understanding the different types of malware...

will help you protect their systems -- and pass the SSCP certification exam. This excerpt, from the Official (ISC)²® Guide to the SSCP® CBK® Domain 7: Malicious Code, by Diana-Lynn Contesti, takes a look at double file extensions. Download the full Domain as a PDF to learn about the different types of malware and their payloads.

Viruses, worms and Trojan horses all make use of the double file extension. The Windows operating systems allows the creation of files names with a number of spaces in it. This trick is intended to fool users into believing that the file they are viewing cannot be executed. as in this example:


The .EXE at the end of the spaces, makes the program executable. Unfortunately in e-mail, users will only see the .TXT and potentially believe that the file is simply a Text file. This is why much has been done to educate users on not running e-mail attachments.

As a number of file extensions can be used to deliver or contain malicious code, it is recommended that the administrators block specific File Extensions at the Firewall. Table 7.3 is a partial list of suggested file extensions that should be blocked.

It is difficult for end users to understand all the file extensions that can be used and those that may be considered dangerous or Executable. Therefore, it is a good idea to develop a list of extensions that will be blocked at the Firewall by default. Every organization is unique and the list that is correct for one organization may not be correct for another. It is a good idea to educate users on some of the basic file extensions that you may not be able to block (i.e., .EXE, .PIF, .SCR, .COM).

A complete list of file extensions and their meanings is available at The File Extension Source; also view Every File Extension in the World from

Table 7.3 A Partial List of File Extensions That Should Be Blocked

File Extension Descriptions
Acrobat Plug-in
Used to view Adobe Acrobat files
Batch processing file
Used to execute a series of commands in a sequential order
Borland package libraries
Used in programs developed with the Delphi software language
Compiled HTML Help file
Could include a link that would download and execute malicious code
Command File
Contains scripts and executables for DOS or Windows
Dynamic Link Library
Executable code that is shared by other programs on the system
Device Driver
Used to extend the hardware support of a Windows machine
Windows binary executable program
Object linking and embedding (OLE) control
Used to orchestrate the interaction of several programs on a Windows machine
Program Information File
Used to tell windows how to run non-Windows applications
Screen saver programs
Includes binary executable code
System configuration file
Used to establish system settings
Visual Basic® files (VBE and VBS)
Used to script in visual basic which is built into many Windows-based machines
Windows Script Host Settings File
Used to configure the script interpreter program on Windows machines

Official (ISC)²® Guide to the SSCP® CBK®
By Diana-Lynn Contesti, Douglas Andre, Eric Waxvik, Paul A. Henry, Bonnie A. Goins
Published by (ISC)2 Press
ISBN # 9780849327742; Copyright 2007; Pages: 573; Edition: 1st

Chapter: Domain 7: Malicious Code
By Diana-Lynn Contesti, CISSP-ISSAP, ISSMP, SSCP

This was first published in August 2007

Dig Deeper on Threat management and prevention



Find more PRO+ content and other member only offers, here.



Forgot Password?

No problem! Submit your e-mail address below. We'll send you an email containing your password.

Your password has been sent to: