Operation for decompression bomb

There is no optional operation for decompression bomb in AVAST. Understanding that in some cases, decompression bomb may do no harm, I suggest to add optional operation for it cos it can possibly be malwares.

Also, about submission from virus chest.
Bulk submission function, i.e. submitting more than one file at one time, is suggested.
If I have many samples to submit, it’s very tiring to select a file for submission on by one.

You can ignore the decompression bomb files.
But you can change values into avast5.ini file to configure how avast should work with these files.
It’s not user friendly, but it is possible.
http://forum.avast.com/index.php?board=2;action=display;threadid=1647

Great! Thank you!

You’re welcome.

But such configuration can only make AVAST scan the file instead of identifying it as a decompression bomb, right?

In all honesty why would you want to even consider scanning it, when it is an inert archive file.

Archive (zip, rar, etc.) files are by their nature are inert, you need to extract the files and then you have to run them to be a threat. Long before that happens avast’s Standard Shield should have scanned them and before an executable is run that is scanned.

Thank you. I know archive files are inert. I ask because I seemed to find a non-archive file identified as a decompression bomb by AVAST. And that file was detected as a malware by other AV. So I surmise if AVAST can remove decompression bomb, it may improve security level.

You don’t need an AV for that.
Just delete the archive, if you don’t need/want it.

OK
Ask another off-topic question.
How to change the signature of my profile?
Thank you

You need 20 posts to do that.

Thank you
It seems I’m too silent. ;D

You’re welcome…!
And you’re not far away… :wink:

Since you don’t give any examples of the file/s considered as a decompression bomb (file name and file type), I can’t comment on that.

The decompression bomb name is not an indication that it is infected, just that it hasn’t been scanned as to do so would require extraction and that would be very large.

The name really is the most dangerous thing about this and I wish they would change it or simply not report it, a real PITA.

+1

I see…
So further analysis is required for those decompression bomb.
Many thanks

Sample
VT
http://www.virustotal.com/file-scan/report.html?id=5d8bd89f562b7661c20b6da279cab3920a447e4154890aaef211ef98bb33a7b7-1312688923

AVAST scan result of the file can be seen in the attachment.

The file that is first opened 0723-easy_life(57).exe is essentially an archive, a compressed installation executable (which is an exception to archives being scanned). The |> bit after the 0723-easy_life(57).exe name indicates that this is more than a single file and there is another executable update.exe which may also be a large file.

Presumably this is something which you downloaded (and from where) ?
Given that it is in a temp \desktop\temp\ location and the VT results believe it to be infected it could be removed manually) ?

OK
I understand now. Thank you so much for your explanation.

You’re welcome.

Actually, if you don’t mind and have time, would you please help me again explain this post?
http://forum.avast.com/index.php?topic=82589.0
Many thanks.