|
|
I ran a scan with Avast home version in normal mode. Avast came back with
about 10 or so results that said, "Unable to scan: The file is a
decompression bomb." I put them in quarantine and ran another Avast scan in
Safe Mode yesterday and they weren't there.
When I Googled "decompression bomb" I found a post at a forum where someone
said that, "Typically such a bomb is a multi-level packing thing -- data's
compressed with one packer (e.g. into a zip), then the resulting archive file
is in turn packed (usually with a different packer), and so on several times.
We had a thread here a while back reporting avast and system crashes from
trying to scan an apparently small file (50 or 100K, if I remember) which
would have eventually expanded, if disk space and memory were available, to a
couple of hundred gigs."
My computer is running fine but I don't want these files taking up all that
space for nothing. Can I delete these files from quarantine?
--
Denise
~ If you don't know where you came from, you won't know where you're going.
|
|
Denise <Denise[ at ]discussions.microsoft.com> wrote:
[Quoted Text] > My computer is running fine but I don't want these files taking up
> all that space for nothing. Can I delete these files from
> quarantine?
Yes.
--
XS11E, Killing all posts from Google Groups
The Usenet Improvement Project: http://blinkynet.net/comp/uip5.html
|
|
The link that you posted has nothing to do with decompression bombs.
--
Denise
~ If you don't know where you came from, you won't know where you're going.
"XS11E" wrote:
[Quoted Text] > Denise <Denise[ at ]discussions.microsoft.com> wrote: > > > > My computer is running fine but I don't want these files taking up > > all that space for nothing. Can I delete these files from > > quarantine? > > Yes. > > > -- > XS11E, Killing all posts from Google Groups > The Usenet Improvement Project: http://blinkynet.net/comp/uip5.html> |
|
Denise <Denise[ at ]discussions.microsoft.com> wrote:
[Quoted Text] > The link that you posted has nothing to do with decompression bombs.
I didn't post a link.
--
XS11E, Killing all posts from Google Groups
The Usenet Improvement Project: http://blinkynet.net/comp/uip5.html
|
|
Before you go ahed and remove them all, do consider where the file came
from, there's a good possibillity that the file could be O.K. while the
algorithm that Avast is using has trouble analyzing this multi-packaging
correctly at all times. One person on the forum you mentioned also says how
only one out of several of these files that he compressed himself was
flagged this way. If you trust the app that the file belongs to, then I
would leave it where it is.
It's no use trusting your anti-virus to dispose of your data, before
accepting any suggestion you should try and find out what kind of file it is
and where you got it from - if for nothing else, you may need it badly one
day, so where will you go then?
Tony. . .
"Denise" <Denise[ at ]discussions.microsoft.com> wrote in message
news:D0580B4F-13EC-4C59-8BAB-6233CB43A8B4[ at ]microsoft.com...
[Quoted Text] > I ran a scan with Avast home version in normal mode. Avast came back with
> about 10 or so results that said, "Unable to scan: The file is a
> decompression bomb." I put them in quarantine and ran another Avast scan
in
> Safe Mode yesterday and they weren't there.
>
> When I Googled "decompression bomb" I found a post at a forum where
someone
> said that, "Typically such a bomb is a multi-level packing thing -- data's
> compressed with one packer (e.g. into a zip), then the resulting archive
file
> is in turn packed (usually with a different packer), and so on several
times.
> We had a thread here a while back reporting avast and system crashes from
> trying to scan an apparently small file (50 or 100K, if I remember) which
> would have eventually expanded, if disk space and memory were available,
to a
> couple of hundred gigs."
>
> My computer is running fine but I don't want these files taking up all
that
> space for nothing. Can I delete these files from quarantine?
>
> --
> Denise
>
> ~ If you don't know where you came from, you won't know where you're
going.
|
|
No link was posted. Only a 1 word answer. I personally would wait several
weeks before deleting them, then I agree that if you have no problems, which
would be expected, you can delete them. OTOH you can always just archive
them to a RW DVD/CD.
"Denise" <Denise[ at ]discussions.microsoft.com> wrote in message
news:FB207A7C-EFCB-4189-AFC1-47293EC26C66[ at ]microsoft.com...
[Quoted Text] > The link that you posted has nothing to do with decompression bombs. > -- > Denise > > ~ If you don't know where you came from, you won't know where you're > going. > > > > > "XS11E" wrote: > >> Denise <Denise[ at ]discussions.microsoft.com> wrote: >> >> >> > My computer is running fine but I don't want these files taking up >> > all that space for nothing. Can I delete these files from >> > quarantine? >> >> Yes. >> >> >> -- >> XS11E, Killing all posts from Google Groups >> The Usenet Improvement Project: http://blinkynet.net/comp/uip5.html>>
|
|
"John Barnes" <jbarnes[ at ]email.net> wrote:
[Quoted Text] > No link was posted. Only a 1 word answer. I personally would
> wait several weeks before deleting them, then I agree that if you
> have no problems, which would be expected, you can delete them.
> OTOH you can always just archive them to a RW DVD/CD.
John, FWIW, she said:
"My computer is running fine" so I assume (yeah, I know!) that they're
safe to delete. Maybe one way would be to move them to the recycle bin
for a few days?
Don't you think "several weeks" is probably longer than needed?
--
XS11E, Killing all posts from Google Groups
The Usenet Improvement Project: http://blinkynet.net/comp/uip5.html
|
|
I just feel more secure to keep them available basically as long as it
usually takes me to use the bulk of the programs on my computer (recycle bin
is great, too), unless I know what they are associated with. I usually use
most of my programs each month or uninstall them. I have never seen a multi
level archive that is used in the normal course of programs running, though
single level archives do get used. Most of my multi level archives have
been BIOS upgrades that get multiple layers of .zip and .rar files.
"XS11E" <xs11e[ at ]NOSPAMyahoo.com> wrote in message
news:Xns9954853F3B490xs11eyahoocom[ at ]127.0.0.1...
[Quoted Text] > "John Barnes" <jbarnes[ at ]email.net> wrote: > >> No link was posted. Only a 1 word answer. I personally would >> wait several weeks before deleting them, then I agree that if you >> have no problems, which would be expected, you can delete them. >> OTOH you can always just archive them to a RW DVD/CD. > > John, FWIW, she said: > > "My computer is running fine" so I assume (yeah, I know!) that they're > safe to delete. Maybe one way would be to move them to the recycle bin > for a few days? > > Don't you think "several weeks" is probably longer than needed? > > > -- > XS11E, Killing all posts from Google Groups > The Usenet Improvement Project: http://blinkynet.net/comp/uip5.html
|
|
I'll have to run another Avast scan to get a good look at the
file/folder/program that it belongs to. I couldn't get a report from Avast
or even copy and paste the names of bombs. There was a mix of the
compression bombs with other files so that there were about 100 files that
Avast found.
Thanks for your input everybody.
--
Denise
~ If you don't know where you came from, you won't know where you're going.
|
|
|