Avast pre release 5.0.492 problems/crashes

[Dave78]

Couple of problems I'm having with even the latest pre release 5.0.492 Home/Free edition AV.

1. Scanning a large file by right clicking on it, say 1.25GB in size. I know that Avast most always sees one file this size as a Decompression Bomb and therefore, doesn't scan it, but few seconds into the scan, pops up the warning, error...this is a decompression bomb. So exit out of the popup window at the top right, crashes Avast.

So here is the window when it first crashes..

Then clicking on that Close the program, pops up again with second window. Then it finally exits out of avast.


2. Something that has been happening for a while with builds.
Downloading something, from Firefox let's say, and if I right click on avast icon, and disable all shields, it will disable them, but cut off the download. In other words, the download will stop short and finish, even though it's not finished. Why does this happen? It should not in my opinion.

3. After disabling all shields, then turning back on again, the right click context menu scan on any files, does nothing. No action is taken. Have to reboot, in order for the right click scan to work again.

Hope it will be looked into.

[Vlk]

1. Scanning a large file by right clicking on it, say 1.25GB in size. I know that Avast most always sees one file this size as a Decompression Bomb and therefore, doesn't scan it, but few seconds into the scan, pops up the warning, error...this is a decompression bomb. So exit out of the popup window at the top right, crashes Avast.

We will try to simulate that... Thanks for reporting.

2. Something that has been happening for a while with builds.
Downloading something, from Firefox let's say, and if I right click on avast icon, and disable all shields, it will disable them, but cut off the download. In other words, the download will stop short and finish, even though it's not finished. Why does this happen? It should not in my opinion.

Yeah, this is caused by the WebShield. WebShield works as a web proxy, which means that it will overtake all the HTTP connections your browsers make. Now, when you actually stop it, the proxy gets unloaded and all the established HTTP connections are reset.

This is unfortunately by design, sorry for that.

3. After disabling all shields, then turning back on again, the right click context menu scan on any files, does nothing. No action is taken. Have to reboot, in order for the right click scan to work again.

Don't seem able to simulate this one.
When this is simulated, you can still normally access the GUI via the tray icon, correct?


Thanks
Vlk

[Sparxx]

1. Scanning a large file by right clicking on it, say 1.25GB in size. I know that Avast most always sees one file this size as a Decompression Bomb and therefore, doesn't scan it, but few seconds into the scan, pops up the warning, error...this is a decompression bomb. So exit out of the popup window at the top right, crashes Avast.

- it would be great if you'd say what type of file did you scan , because i tried to scan a 3 Gb rar file and a 4 Gb ISO and all is working like it should .

[Dave78]

1. Scanning a large file by right clicking on it, say 1.25GB in size. I know that Avast most always sees one file this size as a Decompression Bomb and therefore, doesn't scan it, but few seconds into the scan, pops up the warning, error...this is a decompression bomb. So exit out of the popup window at the top right, crashes Avast.

We will try to simulate that... Thanks for reporting.

2. Something that has been happening for a while with builds.
Downloading something, from Firefox let's say, and if I right click on avast icon, and disable all shields, it will disable them, but cut off the download. In other words, the download will stop short and finish, even though it's not finished. Why does this happen? It should not in my opinion.

Yeah, this is caused by the WebShield. WebShield works as a web proxy, which means that it will overtake all the HTTP connections your browsers make. Now, when you actually stop it, the proxy gets unloaded and all the established HTTP connections are reset.

This is unfortunately by design, sorry for that.

3. After disabling all shields, then turning back on again, the right click context menu scan on any files, does nothing. No action is taken. Have to reboot, in order for the right click scan to work again.

Don't seem able to simulate this one.
When this is simulated, you can still normally access the GUI via the tray icon, correct?


Thanks
Vlk

Thanks for the response.

And thanks for the explanation of why it cuts the download. I guess it's fine at least to know why it does it.


Yeah, can still access the GUI from the tray icon, and everything still appears normal, just the context menu scan wasn't responding after I disabled all shields until reboot, then enabled back on again after a little while, thn tried to scan things with right clicking on them.


The large file I was scanning was a RAR file, about 1.25GB in size, which contained an ISO, and a couple word/excel documents. I can reproduce the crash everytime.


One more thing I forgot to mention.

When scanning with the context menu scanner, it doesn't report the right size of Data scanned. It's always a lot larger size then what it scanned. Like scanning a 700Kb file will say 1. something GB in size.  See example.

[DavidR]

The context scan is reporting what it actually scanned, e.g. all the files it unpacks to scan and not what windows explorer reports as the packed file size. So from that one file, 4504 files were unpacked and scanned.

So this single packed file has a very high compression ratio.

[bikemanAMD]

Problem possibly related to Avast 5.0.492 Update

Updated Rebooted
Opened Secondlife Viewer 2
Then Tried to Open Frostwire
and it froze both Second Life and Frostwire

Closing VIewer 2, and Reopening Old Viewer of Second Life 1.23, and Working Fine now

Not sure if related to Avast or not, i will test again later

[MikeBCda]

With regard to ID-ing the supposed decompression bomb, the file type is definitely significant.  Avast doesn't normally have problems scanning even very large "normal" (i.e., uncompressed) files, although the Chest and submission to Alwil, if either is relevant, would be a problem.

The usual definition of a decompression bomb, and avast probably works on the same basis, is when the size ratio of the ultimately expanded files to the original archive is very high, usually because there are multiple layers of archiving used ... if a 100K archive ultimately expands to a few gigs in files, that's a classic (if extreme) example.

If a large, say 5 gig, file (or group of files) was compressed once, down to maybe 1.5 or 2 gigs, that wouldn't be a "bomb".  And avast shouldn't have a problem with it, other than of course the time involved.

Sorry if I've wandered a little off-topic, there's a number of good discussions and explanations on decompression bombs all over the forums here.

[Dave78]

@DavidR

That makes sense about the compression, thanks.

[DavidR]

You're welcome.