Avast and decompression bomb??

[Steph]

Strange result on my latest Avast scan:

C:\WINDOWS\Internet Logs\tvDebug.zip\tvDebug_2009-12-15-18-56-36.log

Unable to scan : The file is a decompression bomb

I know that a decompression bomb is a zipped file that when unzipped releases a very large amount of data but I don’t know whether this file is legitimate and the result of the scan is (yet another) false positive and or if it’s potentially malicious and should be deleted. I don’t recognise the file itself but I’m also confused that its an Internet Log – I use CCleaner at the end of each day so shouldn’t all internet files be deleted? And if it’s a log, what’s creating it?

Please could someone advise what I should do with it and whether it’s safe to delete and if so, the safest way to do this?

Thank you.

Steph

[arraknid]

Hi Steph,

If you are still using it, the file is created by ZA and is perfectly normal. It contains details of ZA activity and should only be a small size 5 - 25Mb. I'd say it is a false positive, but if you wish, you can delete it. Avast tends to label things in that way when it can't access the file to scan it. To prevent it reappearing and taking up disk space, you can shut it down. This will explain. That said, it does no harm and can be left as is.

Come down off the ceiling yet?

[Steph]

No, still floating - must be all that champagne!

Thanks for the advice - when I looked at your link, the third file in the Internet Logs folder on the list to mark as read only in the instructions was tvDebug.log - is that the zipped folder named tvDebug (the only other file of that name in the Logs folder is the .txt file)? And if I delete it, will it be recreated and need deleting again from time to time or will marking it read only effectively put it out of action?

As you said, the file sizes are very small - the Internet Logs folder is only 15 mb and the tvDebug zipped folder is only 975 kb - strange Avast should have only just started picking it up, I've had ZA for ages. The Avast false positives seem to be coming thick and fast at the moment, I wish they'd sort them out!

Steph

[arraknid]

If you make the three files 'Read only', the logging will stop and the .zip file will stay as it is. As I said, you can delete it, but only that file.

Avast, like other AV software, tries to be as aggressive as it can, without going too far, but occasionally it pops up with a false positive. Actually, it's more to do with interpretation. As I said, Avast tries to scan everything, but when it can't, it throws up a warning, thinking it's malware. Better to have FP's than to miss real problems, I guess.

[Steph]

Hi Arraknid, apologies for the delay in following up on your last post.

Please can I just check something with you which I'm still not quite clear about? In the instructions you posted, the three folders to be made read only were :

fwdbglog.txt
fwpktlog.txt
tvDebug.log

The first two .txt files I have as listed and are straightfoward but neither of the two tvDebug files I have end with a .log extension- one is a .txt notepad file and the other is a zipped folder. It does say in the instructions not to make any of the other files read only apart from the three listed- so which one of the two tvDebug files is the .log file and the right one to make read only - would it be the tvDebug.txt?

Sorry if I'm being a bit dense - it's all that Xmas pudding clogging up the brain cells.

Thank you.

Steph

[arraknid]

Hi Steph,

tvDebug.log should be there, but even if it isn't, it won't matter. You could try a Search for the file, or check the Avast chest. As I say though, it isn't important.

it's all that Xmas pudding clogging up the brain cells.

Aren't you supposed to put it in your mouth??

[Steph]

Aren't you supposed to put it in your mouth??

Yes, but then it travels to the brain and sticks to the brain cells, interfering with neural pathways - it's a special property of Christmas pudding. Then it makes you fall asleep with your mouth open.

I searched for a tvDebug.log file and there isn't one anywhere. The Avast chest doesn't contain one either. I have four relevant files :

fwdbglog.txt
fwpktlog.txt
tvDebug.txt
tvDebug - (zipped folder)

I turned off ZA as per the instructions, made them all Read Only (ticked apply then OK) and then ran a scan. Still the same result. When I reboot, none of the files are read only anymore - whatever I do, I can't seem to keep them as read only.

Any ideas please?

Steph

[arraknid]

To be honest, this isn't that much of a problem. If you've set Avast to ignore the file, it shouldn't appear again in a scan. If you want to delete the .zip file, you can, then just leave the others as they are. You'll probably never see or hear from any of them again. You could switch off the creation of all log files in ZA, but you may need them one day, so best to leave things as they are.

Any ideas please?

How about a nice glass of wine, a huge box of chocs and a roaring log fire?