Hi,
Running Avast home 4.6 and up to date with the data base, the last scan has found 3 cases of a decompression bomb entitled.
VTS_02_1.VOB TO 04_1.VOB AND
VTS_05_0.BUP about which Avast said :- An attempt was made to move the file pointer before the beginning of the file.
Trying to delete them said :- the operation is not supported for this kind of archive, and moving them to the chest started a lot of hard disk activity, after a minute and a half I had to pull the mains plug as the only way to stop the PC.
Avast also said No of infected files 0 on a standard scan. I opened the infected directory but no files were shown deleted it, a re-scan then gave the same result four bombs.
Have you a cure please.
Max.
By way of first aid. Assuming you know where these decom bombs are, rename them (doesn’t matter into what). Then reboot and delete them (to the recycle bin).
If they come back, more information is needed !
*.VOB is a DVD video format file…
Indeed RejZoR. If “BUP” decompresses them…
He must get rid of that stuff as soon as possible.
The files are probably just incorrectly detected as some kind of archive (which they are not - they are video files, as Rejzor explained). So, you don’t have to worry about it and simply ignore avast! warnings.
How big are the files? If some of them is small, I would like to check the files (especially the .BUP one) and to see why they are detected as an achive. Do you think you could upload it to our anonymous FTP at [b]ftp://ftp.asw.cz/incoming[/b] ? (as I said, only the small files, if any; normally, the VOB files are 1GB in size).
Hi,
Have tracked the file/s they’re in a Winrar archive file, 4 Gig so I can’t send them, needless to say they won’t be unpacked just deleted, most of the files shown are in Nero showtime format.
If you really wan’t a copy I could try burning it to disk and posting it, if I don’t hear from you by Tues AM I’ll delete the Winrar file.
Thanks,
Max
P.S. If you can, contact me sooner, I’d like to delete it yesterday !
OK, it doesn’t matter, you can delete the files.
(Though, as I was trying to explain - there is no reason to delete them unless you really want to get rid of them; the avast! warnings do not mean that they are dangerous, infected, or anything like that).
Thanks igor,
I chickened out and have deleted the winrar file, after reading up on bombs and DoS, better safe than sorry.
Thanks for all your advice,
Max.
Decompression bombs aren’t really that dangerous. They are more a killer for file server scanners and mailbox scanners, because they can crash/slowdown entire server and render that service unusable (and we all know how much server downtimes cost if you run a payable service)