Hello. I recently encountered a decompression bomb and read about them on this (Avast) forum…somewhere. Anyway, the tech recommended one thing to do was download and run “Malwarebytes” program to check for any other nasty things that might be hiding in the computer. I did for each computer. One of them came up with 2 trojans and quarantined them. I’ve restarted the computer a few times and nothing seems to have changed in regard to system operation. So what do I do with the Q’d trojans? The log file says they are Q’d and deleted, but they are still listed in the quarantine list. (I’ll attach the log file.) Also, how can I tell they are not false? The Help tab on the program is not detailed enough for a novice to handle this stuff.
Thanks in advance for any help on this.
These detections are from one (or two) of your system restore points. There is actually no way to easily find out if they are the real deal or not, and what I’d be inclined to do is forget about them, or delete them. Be aware that the restore points involved will probably not be usable if you ever call upon them.
“Deleted and quarantined” means they were deleted from their original location on your computer, and moved to quarantine. That’s why they are still listed there.
Are you OK with what was said about the “decompression bomb”? (Basically an archive with a very high/dense compression ratio, these can be suspicious, more so in the past, I believe, but are considered less likely to carry a threatening payload these days.) Did you scan that particular archive with MBAM?
Hello again, Tarq. Being as those files are just system restore points, I’m not worried about deleting them, I just did not know what they are and if deleting them was the correct action to take. Their help files aren’t very explicit. The infected computer is a brand new laptop only 15 days old. I can’t imagine how the trojans got there…unless they came with it (Acer Aspire One). As far as the D-Bombs, Avast found 2 of those on one of my other computers. At first, I was a bit excited/worried, but after reading that thread a few times, what the techs were saying sank in…basically, Don’t Panic! I’m guessing that this occurs with zip files only, and if this is true, that is all the scan is detecting. The odd part is, in the same little group of unzipped zip files I have in one folder, there are 2 other zip files that are significantly larger than the ones singled out, but they didn’t register as D-Bombs. I ran Malwarebyte on that computer after reading about the program, but everything came back with no problems found. So, there’s where I’m at.
Thanks again Tarq!
No problems, and you’re welcome. It’s the compression ratio of a compressed file that is the issue, rather than the size of it. (Zips are but one type of file compression.)
It’s always a good idea to keep detected malware in quarantine rather than deleting it, until it is investigated a bit more. And in many cases, it can be a good idea to investigate it before quarantining it.
Here is a good place to ask. Google is also very good for basic research of file names, to get an indication of whether they are likely to be harmful, or how harmful. And on the odd occasion, there could be a FP detected by some programs that, if deleted, can make the computer unable to be booted.