Redundant ActiveX applications installed ?

[Port_H]

Hello. I'm a Spybot user from Portugal. Since more than 2 years that I use this program, because I think it confers an important additional layer of protection to Internet explorer, making it more safer to navigate the Web. Today I upgraded from version 1.4 to version 1.5. I have some few questions reguarding the program. I'll post them separately in different threads.

Question 1. The Spybot tool "ActiveX" show me 3 ActiveX applications with the same name and MD5 installed in my system. When opening Spybot for the first time, only one of them is classified as legitimate, but opening Spybot a second time, all 3 are then classified by the program as legitimate (which i think kind of strange). I don't know if i should try to uninstall the ones that are redundant, or if they pose some kind of threat or could cause instability to my browser. I copied the following from "SpybotSD.ActiveX report.txt" created by me when running Spybot the first time after reinstalling it:

{8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0)
          DPF name: Java Runtime Environment 1.6.0
        CLSID name: Java Plug-in 1.6.0_02
         Installer: 
          Codebase: http://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab
       description: Sun Java
    classification: Legitimate
    known filename: %PROGRAM FILES%\JabaSoft\JRE\*\Bin\npjava131.dll
         info link: 
       info source: Patrick M. Kolla
              Path: C:\Programas\Java\jre1.6.0_02\bin\
         Long name:    npjpi160_02.dll
        Short name:       NPJPI1~1.DLL
    Date (created): 12-07-2007 2:22:38
Date (last access): 27-09-2007 8:50:00
 Date (last write): 12-07-2007 4:00:36
          Filesize:             132496
        Attributes:           archive 
               MD5: E3811F1A1C5063C941EC0E2766C3EA39
             CRC32:           AEFD3747
           Version:           6.0.20.6

 {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} (Java Runtime Environment 1.6.0)
          DPF name: Java Runtime Environment 1.6.0
        CLSID name: Java Plug-in 1.6.0_02
         Installer: 
          Codebase: http://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab
              Path: C:\Programas\Java\jre1.6.0_02\bin\
         Long name:    npjpi160_02.dll
        Short name:       NPJPI1~1.DLL
    Date (created): 12-07-2007 2:22:38
Date (last access): 27-09-2007 8:50:00
 Date (last write): 12-07-2007 4:00:36
          Filesize:             132496
        Attributes:           archive 
               MD5: E3811F1A1C5063C941EC0E2766C3EA39
             CRC32:           AEFD3747
           Version:           6.0.20.6

{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} (Java Runtime Environment 1.6.0)
          DPF name: Java Runtime Environment 1.6.0
        CLSID name: Java Plug-in 1.6.0_02
         Installer: 
          Codebase: http://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab
              Path: C:\Programas\Java\jre1.6.0_02\bin\
         Long name:    npjpi160_02.dll
        Short name:       NPJPI1~1.DLL
    Date (created): 12-07-2007 2:22:38
Date (last access): 27-09-2007 8:50:00
 Date (last write): 12-07-2007 4:00:36
          Filesize:             132496
        Attributes:           archive 
               MD5: E3811F1A1C5063C941EC0E2766C3EA39
             CRC32:           AEFD3747
           Version:           6.0.20.6

Note that they seem to be almost identical, except for the code inside {} and the "info source" information which is "Patrick M. Kolla" in the first one and is absent in the last 2, but change afterwards to "Safer Networking Ltd." when their classification shifts to "legitimate" after reopening Spybot-S&D.

I appreciate your attention.

 

[PepiMK]

The important part here is the GUID; the part between the { and the }. This is a unique identifier for software. And if Sun likes to identify their software with multiple IDs, that creates a bit of confusion, but still is legit. It also doesn't take up a lot space really - it's still just one file, only with multiple entries. I would suspect that this is a method Sun/Java uses to allow Java programs to use either a very specific version, e.g. 1.6.0.2 through your second entry, or any version at all, e.g. your third entry, with your first entry maybe a backward compatibility entry from a time when they didn't have version numbers as part of the GUID (I have 5 entries in total, 3 for 1.6.0.2, one for 1.6.0.1 and one for 1.6.0.0).

Btw, did you update between the two different displays (once only one legitimate, the other time all three)?

 

[Port_H]

No, i didn't update Spybot-S&D between the two different "ActiveX" displays, only exited and restarted the program.
I guess i know why you have one entry for Java plug-in 1.6.0.1 and one for 1.6.0.0. besides the 3 entries for 1.6.0.2 that i have. Please go to "Add and remove programs" in your Windows Control panel and check if you have more than one version of Java Runtime Environment. Because when I updated Java to "Java 6 Update 2", the previous version "Java 6 Update 1" was not automatically uninstalled or replaced by the new, and as i saw it occupied more than 100 MB of hard disk space, i then uninstalled it manually, and kept only "Java 6 Update 2". I decided to to so after going to "C:\Program Files\Java" and verifying that were 2 folders there: jre1.6.0_01 and jre1.6.0_02 containing each one, files with identical names from the ones in the other.
I will check when i can if there is a new updated version of Java, and, when so, install the new version and uninstall "Java 6 Update 2", and then, check back Spybot "ActiveX" tool.