Author Topic: What is a decompression bomb.  (Read 375394 times)

0 Members and 1 Guest are viewing this topic.

Dylan212

  • Guest
Re: What is a decompression bomb.
« Reply #30 on: April 25, 2009, 06:10:39 PM »
Hey guys thanks for helping so many people.

I have a new question about this topic though. I have 40 bombs and 285 "Unable to scan: file is password protected"

Should I be concerned with the amount of bombs I have? I download a lot of videos, I think that's why I have so many. But Avast scanned them while they were being DL'd so they should be fine.

How can I remove the PW protection on those other 285 files so they can be scanned?

Thanks Dylan

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67235
Re: What is a decompression bomb.
« Reply #31 on: April 25, 2009, 07:57:04 PM »
Should I be concerned with the amount of bombs I have?
No. Not really.

How can I remove the PW protection on those other 285 files so they can be scanned?
avast can't scan files that are password protected, it doesn't know the password.
There are many legitimate reasons why a file was password protected. For instance, Lavasoft Ad-aware and SpyBot store their data in a password-protected ZIP archives (to prevent other similar tools from messing up with them). It's really nothing to worry about - it's normal.

In AdAware and S&D, when you fix/remove things it keeps backup/recovery information so you can restore anything that was mistakenly fixed/removed, etc. After a reasonable time your system has suffered no adverse effects, you can get rid of the older recovery/backup points. This should reduce the number of protected files.
The best things in life are free.

Dylan212

  • Guest
Re: What is a decompression bomb.
« Reply #32 on: April 25, 2009, 08:23:29 PM »
Oh ok thanks

So should I move these things into a chest, delete or "move" or something? Sorry Im new to Avast.


Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67235
Re: What is a decompression bomb.
« Reply #33 on: April 25, 2009, 08:32:15 PM »
Oh ok thanks

So should I move these things into a chest, delete or "move" or something? Sorry Im new to Avast.


No. They could stay as they are. You can set the report options to "Infected" only files and no "errors", than these files won't be showed in the report.
If any infected file come "out" of the bomb or the passworded files, they will be caught by the avast resident. Don't worry.
The best things in life are free.

Dylan212

  • Guest
Re: What is a decompression bomb.
« Reply #34 on: April 25, 2009, 08:49:18 PM »
great thanks bud, youre the best!

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67235
Re: What is a decompression bomb.
« Reply #35 on: April 25, 2009, 08:55:36 PM »
great thanks bud, youre the best!
You're welcome ;)
The best things in life are free.

tyne_charmed

  • Guest
Re: What is a decompression bomb.
« Reply #36 on: May 08, 2009, 08:36:53 AM »
NEED HELP...GOT THIS RESULT AFTER SCANNING: Please see attachment... I just made a screen shot since there so many of them...please help...thanks!!!

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67235
Re: What is a decompression bomb.
« Reply #37 on: May 08, 2009, 01:38:00 PM »
Can you schedule a boot-time scanning?
Start avast! > Right click the skin > Schedule a boot-time scanning.
Select for scanning archives.
Boot.
If infected files are found, it's safer to send them to Chest instead of deleting them.
This way you can further analysis them.

By examining 1) the reason given by avast! for not being able to scan the files, 2) the location of the files, you can get an idea of what program they relate to. You may need to expand the column headings to see all the text.

1. Files that can't be scanned are just that, not an indication they are suspicious/infected, just unable to be scanned.
2. Also, the packaging of the file could have some error, or use a non-standard pattern...
3. Access denied means, generally, that the file is in use by another process (program) and cannot be repaired/cleaned/moved/handled by avast!
4. avast can't scan files that are password protected, it doesn't know the password. There are many legitimate reasons why a file was password protected. For instance, Lavasoft Ad-aware and SpyBot store their data in a password-protected ZIP archives (to prevent other similar tools from messing up with them). It's really nothing to worry about - it's normal.
The best things in life are free.

lewislink

  • Guest
Re: What is a decompression bomb.
« Reply #38 on: May 08, 2009, 05:37:37 PM »
I was wondering if anyone can help me make sense out of thse decompression bombs? Would they be okay to delete?


Online DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 87286
  • No support PMs thanks
Re: What is a decompression bomb.
« Reply #39 on: May 08, 2009, 07:19:54 PM »
It is no different from the various answers given throughout this and other topics, they are just very large compressed files, which when uncompressed would be very large. So you only need to check the tvDebug.zip (whatever that is) file size to see that they are very large.

I would also suggest that you do some house keeping and remove some of the old log files within it (tvDebug.zip) as the ones shown in yo image date back to April. This would free up valuable free space and reduce the numbers reported as decompression bombs.

As has been said numerous times, Files that can't be scanned are just that, not an indication they are suspicious/infected, just unable to be scanned.
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 22.12.6044 (build 22.12.7758.768) UI 1.0.741/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

lewislink

  • Guest
Re: What is a decompression bomb.
« Reply #40 on: May 08, 2009, 09:36:42 PM »
This is what happens when I try to delete the bombs:


Online DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 87286
  • No support PMs thanks
Re: What is a decompression bomb.
« Reply #41 on: May 08, 2009, 09:42:59 PM »
That is I believe a repercussion of what is reported of it being a decompression bomb, the file ee.g. the zip file would have to be opened and delete the file/s inside.

Don't try to delete them from avast, use explorer and open the tvDebug.zip file and delete some of the old .log files contained inside.
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 22.12.6044 (build 22.12.7758.768) UI 1.0.741/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

sparge

  • Guest
Re: What is a decompression bomb.
« Reply #42 on: June 02, 2009, 09:07:06 AM »
Hello, a new user with another new angle on this decompression bomb business. I note all the preceding caveats about how they probably are nothing to worry about, and how they can be checked out outside of Avast if necessary. The one Avast just reported for me is associated with the intray of a user email account:

 ... email/mail/local folders/PartNo_0#1328536678

How can I identify which email is responsible? At the very least I want to know what it is and who sent it.

Andy

Online DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 87286
  • No support PMs thanks
Re: What is a decompression bomb.
« Reply #43 on: June 02, 2009, 03:44:54 PM »
What is your emai program ?

It probably won't be one email, rather the mailbox concerned.

have you any idea how many email programs work in relation to mailboxes (inbox, etc), well it is just a single (database) file with all the emails in that email folder contained within it. That could make for a very large file.

If you use your inbox for general storage, then I suggest you treat it like an in tray in an office, stuff comes in and is place in the in tray. It is then read and any action taken and is then filed into another tray, 'pending,' 'out' and from there is filed in a filing cabinet under a folder more appropriate for its content. The same applied to your email once dealt with place in a differen folder.

That way you keep the inbox relatively empty; the inbox is the most likely to be corrupted and or deleted as it is to one usually open if you have a crash, etc. This also has the effect of balancing the email folder sizes so one doesn't get enormous.

So I don't know what your email client is or how your email folder structure looks like, e.g. if you have one called PartNo_0#1328536678 or if you have an email with that subject title, as such I can't suggest how to find it.
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 22.12.6044 (build 22.12.7758.768) UI 1.0.741/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

sparge

  • Guest
Re: What is a decompression bomb.
« Reply #44 on: June 03, 2009, 02:27:19 AM »
We're using Thunderbird. Yes, I did know that email was often treated as a database, and Thunderbird certainly does - however, it would not have occurred to me that a virus scanner would have to scan the entire intray as a single file, though. I have checked the size of the intray of the user in question and it is nearly 900 MB! Next closest is 230 MB, then 80 MB, then mine at 29 MB. I have had a polite word in the ear concerned and offered assistance in major surgery  ;)