Decompression Bombs Detected! HEEEEEELP!

system · 2007-03-09T14:39:40.000Z

Avast has picked up 2 decompression bombs on my computer … they are doing exactly what they’re supposed to do,(Causing me connection problems and access problems)!I am not computer savvy… when it comes to this sort of thing. I now(thanks to this site),have a pretty good grasp of WHAT a decompression bomb is,now;HOW do I get rid of it?I’ve read several threads on here talking about what they are,I get that much.Now what do I do to stop them from taking over my computer or HOW do I get rid of them!!! Someone has to know something!Please,if you have any information I would LOVE to hear from you!

Thanks from Bear

P.S. I read a few other post’s and realized that you may want more information… Sorry lol
I’m running XP Home(Brand spanking new install)
What I see in the name of file area is really super long BUT the very last part of it is this:
(#1) Install_Messenger_nous[1].exe\MsnMsgs.msi
(#2) Install_Messenger_nous[1].exe\bootstrap.exe
I haven’t a clue what ALL of this means,so please if you want to help,dumb it down for this Krazy Canadian Lady Bear!

Lisandro · 2007-03-09T15:03:07.000Z

Did you search the forum board? :

Decompression bomb is a file that may be rather small, but decompresses to an enormous amount of data (when processed as a packed archive). Such file are not malicious per se, but they may block an antivirus program when it tries to scan them. This kind of files is rather hard to detect (and avoid) precisely - so, it is possible that there are some false alarms. It's not a big problem in this case, however - the "decompression bomb" announcement actually means something like "The file has a very high, maybe even suspicious, compression ratio and the AV is not going to scan the archive content".

I’d suggest to ignore these files.
But you can change values into avast4.ini file to configure how avast should work with these files.
Click ‘Settings’ in my signature for more info

system · 2007-03-09T15:09:51.000Z

As I stated earlier I did read a lot of the threads/boards . I understand what the thing is,what I want to know is HOW do I stop it from messing with my computer as it is doing now?lol I’m sorry if I posted this in the wrong place BUT I do NOT get most of the language you guys are using lol.I’m trying my best to learn,I feel foolish enough now.I will look at the information you’ve provided me with.
Thanks for the post … Bear

Lisandro · 2007-03-09T15:53:43.000Z

Wolf And Bear post:3:

HOW do I stop it from messing with my computer as it is doing now?

As I’ve stated before, you need to click ‘Settings’ in my signature and browse for the proper info into the avast4.ini file.
http://forum.avast.com/index.php?topic=1647.msg15908#msg15908

system · 2007-03-09T16:17:05.000Z

Thanks “So” much for dumbing things down for me as I had asked.I don’t know what an “ini file” is.Nevermind.I will have a pro come out and look at it since you seem not to get the fact that I am a TOTAL beginner.Thanks for trying.As a side note,you may want to take into account that people are not all super computer savvy like yourself and maybe handle it with a little more tact and politeness.Just because you are far better at this sort of thing does not mean that I am a stupid woman and I do not appreciate being treated as if I am. Thanks for nothing.Have a wonderful day.

Disgruntled Bear

Lisandro · 2007-03-09T17:58:01.000Z

Sorry, I was too technical… let’s step-by-step.

You don’t have to worry that much with ‘decompression bombs’. It was an ‘old’ infection method.
You can manage the ‘infection’ sending the file to Chest (Quarantine) or deleting the file. But, take care, you must ‘need’ these files. Do you know what the strange file Install_Messenger_nous[1].exe do? Did you download it?
About avoiding to see these messages, well, you’ll need to edit the file avast4.ini file.
See here where it is located by default: http://forum.avast.com/index.php?topic=1647.msg10233#msg10233
Add (copy&paste) the following lines at the end of it (to disable the messages):

[Scanner]
MaxFileSizeToExtract_Scanner=0
MaxFileSizeToExtract_Resident=0
MaxFileSizeToExtract_Mail=0
MaxCompressionRatio_Scanner=0
MaxCompressionRatio_Resident=0
MaxCompressionRatio_Mail=0
CompressionCheckThreshold_Scanner=0
CompressionCheckThreshold_Resident=0
CompressionCheckThreshold_Mail=0

Announcements