Assembly Binder Log Entries

[melgish]

I'm commenting here because I found this thread while searching for a similar problem:

 

http://forum.piriform.com/?showtopic=37716

 

The aforementioned thread was quickly shut down with cries of 'we don't do malware' but--in my case at least--the files are from a legitimate source.  The .NET assembly binder.  I've posted one of the files below.

 

When .NET logging is configured every .NET application will create one of these 2k-3k files every time any .NET application is launched.  System applications tend to dump the files in the folder(s) mentioned in that original thread:

 

c:\windows\system32\config\systemprofile\appdata\local\Microsoft\windows\Temporary Internet FIles\Content.IE5

 

c:\windows\syswow64\config\systemprofile\appdata\local\Microsoft\windows\Temporary Internet FIles\Content.IE5

 

Given that these can get quickly out of hand (My C: drive has over 30G consumed by about 7.5 million of the little buggers)

It would be nice if CCleaner had the ability to clean them up along with everything else.

 

 

*** Assembly Binder Log Entry  (12/30/2013 @ 10:06:23 AM) ***

The operation was successful.
Bind result: hr = 0x0. The operation completed successfully.

Assembly manager loaded from:  C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll
Running under executable  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
--- A detailed error log follows.

=== Pre-bind state information ===
LOG: DisplayName = System.Design, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
 (Fully-specified)
LOG: Appbase = file:///C:/Windows/Microsoft.NET/Framework/v4.0.30319/
LOG: Initial PrivatePath = NULL
LOG: Dynamic Base = NULL
LOG: Cache Base = NULL
LOG: AppName = mscorsvw.exe
Calling assembly : (Unknown).
===
LOG: This bind starts in default load context.
LOG: Download of application configuration file was attempted from file:///C:/Windows/Microsoft.NET/Framework/v4.0.30319/mscorsvw.exe.config.
LOG: Configuration file C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe.config does not exist.
LOG: No application configuration file found.
LOG: Using host configuration file:
LOG: Using machine configuration file from C:\Windows\Microsoft.NET\Framework\v4.0.30319\config\machine.config.
LOG: Post-policy reference: System.Design, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a
LOG: Found assembly by looking in the GAC.
LOG: Binding succeeds. Returns assembly from C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Design\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Design.dll.
LOG: Assembly is loaded in default load context.

[hazelnut]

Anyone having this issue could do themselves a favor and read the 3 page thread linked to below. One of the reasons is indeed to do with Assembly Binder Logs which can be viewed by running Fuslogvw.exe. However other apps apart from .Net can cause large Binder Logs.

 

Also there are other reasons for the abnormally large size of Content.IE5  size, one of which is almost always malware

 

http://answers.microsoft.com/en-us/ie/forum/ie10-windows_7/explorer-10-downloading-massive-number-of-files/1b51fbf8-9cc2-4ed2-a150-947d7e02bb5f