decompression bomb

[free_tibet]

Hello, I am a new user of avast! and so far have no complaints. 

I am, however, having a hard time finding detailed information about something avast! is telling me after my most recent scan.  It returned "unable to scan: file is a decompression bomb" in the results screen.  The files are all .cab files (data2, data3, data4) located within an iso DVD image.

I haven't been able to find much information on decompression bombs either here in the forums, help, or just online in general, other than the general gist that they expand by a ridiculous amount when unpacked, potentially locking up your system and/or causing you to lose data, I guess?

So my question is this:  is this something I should be concerned about?  It didn't list the dvd image itself as the decompression bomb, just the .cab files, and since I've never had a need to "unpack" a .cab file manually (I guess installers, etc usually deal with those), I'm not really sure what to make of it.  If anyone could advise as to wether or not all is as it should be, it would be much appreciated.

[DavidR]

A decompression bomb, is basically a file that appears small but has had specialist compression applied so that if uncompressed it would be very large (I don't know the cut off as far as size goes), this could have an adverse effect on your system. In the past these types of things were used to swamp AVs/systems to allow for exploit. In this case it is just indicating it hasn't been scanned.

The warning is just that a very large file when uncompressed for virus checking, not 100% harmful as the intent isn't known. If you know that the compression used on the file is normal, no problem. If however you came to extract said cab file and you knew it wasn't harmful, you could add that file to the standard shield exclusions.

A forum search for decompression bomb should return more information and perhaps a better explanation as this has been covered on a number of occasions.

[free_tibet]

Ok, thanks for the help.

It must be too early in the morning for me (I haven't had any coffee yet).  I looked for the search button before I posted, but just noticed it now.  Thanks for your help.

[DavidR]

Glad I could help, welcome to the forums.