Hello everyone.
I know this topic is really common and often pointless, but it just can’t give me a rest. Today my avast marked one on my files as decompression bomb, most likely I shouldn’t be worried but I have to be sure, just in case. The file name is mpam-b2f70087.exe > mpavbase.vdm located in Windows/ServiceProfile. File was modificated more than one year ago, but avast started to mak it just today. Is it olny a leftover after Windows update, and it’s a comon thing, or there is a possibility of real threat?
Suspicious files can be tested at www.virustotal.com / www.metadefender.com / www.jotti.org
if it say tested before, always click rescan for a fresh result
Thank You for useful links. File is clear.
http://www.bleepingcomputer.com/forums/t/149311/decompression-bomb-found-by-avast/
Note the posting date: 28 May 2008.
I’m surprised Virus Total was able to read the file as it would need to decompress it, and some are known to expand to 100’s of gigabytes in size.
I'm surprised Virus Total was able to read the file as it would need to decompress it, and [b]some are known to expand to 100's of gigabytes in size.[/b]Then you are talking about a real zip bomb This is just a valid file with a high compression, seems to be a Windefender update
Zip bomb > https://en.wikipedia.org/wiki/Zip_bomb
The one from Wiki
First submission 2006-05-27 16:01:36 UTC ( 10 years, 3 months ago )
https://www.virustotal.com/en/file/db6981082063dbb4bac89d27c41fbeb86d9e4a97b36661c0945b77a6b9bb0948/analysis/
Thank you for linking to a classic, ‘42.zip’. I’d forgotten about that one.
Notable avast shows no detection for this, tho, in current VT scan.
The engine on VT may be different? avast usually detect these as a scan error, will not unpack and scan
also it is very old, detection for old never seen anymore crap is removed by many vendors
at jotti avast fail to scan it > https://virusscan.jotti.org/en-US/filescanjob/ivxtc51dtt