I’ve read on the forum that avast 4.5 has decompression bomb protection.
well, I have a small zip file (1.3 mb) that once decompressed is about 18 mb, and when it is scanned is is recognised as decompression bomb.
I think that 18 mb should not be a problem, after all it isn’t 1 gb of data (I can attach the file if needed).
in any case, after I get the message “unable to scan” I click on “action” button and select scan. then avast is blocked doing nothing: no cpu is used, no file is read (according to filemon). after 5 minutes on a centrino 1.5 ghz nothing happened. maybe the process is hung, so I click “cancel” on the “processing results” dialog: nothing happens… I have to kill the process using task manager. I think that at least the “cancel button” should work.
pk, sorry the ‘off-topic’, I coldn’t send you my files as the FTP server was always down… Can you send me an email with full details to upload that files? Thanks.
Well 1,3MB into 18MB isn’t really a decompression bomb.
I made a home one which was only 21KB in size and decompressed into 72MB using Deflate compression and a 5000x5000 24bit BMP image. This is a much higher difference in ratio. Sent it to mail server,but i’m not sure what suppose to happen when decompression bomb passes Internet Mail.
No tag on mail,no warning,nothing.
Yes, i changed limits for decompression bombs (default ratio from 90% → 98%, sure unpacked file size must exceed 10Mb), there’re different values for SShield, Mail and on-demand scan, so if unpacked file size (in emails) exceed 30mb (including that ratio, or not) it’s called ‘mail bomb’.
Well, I can’t login… worse, you send me few information. I’m stupid ;D
Please, exactly what should I write in the ftp application:
Site:
Username:
Password:
I tried and can connect but the connection is not that good.
Vlk asked me for a dump file but I think it will be impossible to send 20Mb this way.
It will be faster in Czech if I took a plane with it in a CD ;D
Well, I’m keep trying.
