How well can Avast catch viruses and such in compressed files? I have been reading that there has been a wave of recent viruses in zip, rar, and other compressed files. Also what is a Compression Bomb? Is that just another word for compressed files?
avast! can scan large set of archives like ZIP,RAR,ACE,CAB,LHA,BZIP,GZIP,7z etc…
It’s nothing unusual,archives are used for email worms for a very long time.
Compression bomb is not the same as just compressed files.
Compressed files are normal files which are compressed to be smaller.
Compression bomb is a different story.
The idea is the same as for normal files,but such boms contain huge file which can be easily compressed (like file full of only zeros,or very high resolution single color bitmap).
So such boms are usually few KB in size,but upon extraction(this includes antivirus file scanning too) these can take up to 100GB of space,consuming all physical memory,virtual memory and hard drive space.
Result is usually complete system block until you restart it. Not so critical for home machines,but very critical for file servers or email servers.
For more detailed info,search for “decompression bomb” in Google.
As far as i know,avast! has the decompression bomb detection mechanism,so it can avoid such situations.
So if I have like five files on my virus scan results that say: cannot scan is a compression bomb, then I should delete them? Are there safe compression bombs, like ones used to maybe make a large file smaller?
BuddyGoodness: please send me couple of those files on my email to obtain more details. Thanks.
Compression Bomb detection mechasnism has to be fine-tuned,so it migh happen that avast! marks a clean archive as decompression bomb. Sending those samples to Alwil will help to fine tune it (to avoid further problems).