AVAST analysis / decompression bomb + ZIP

According to Wikipedia:

A decompression bomb is a type of malware that consists of a compressed file whose decompression uses so many resources that it can freeze the system. It can also be used to occupy the antivirus while a more traditional virus is introduced.


Simple bomb (or repeated data bomb):
This is simply a compressed file, placed anywhere on the hard drive, relatively small in size (not exceeding a few megabytes), which contains a much larger amount of data (several gigabytes) after decompression. To achieve this, a binary file is filled entirely, over several gigabytes, with the same data (0 or 1). Thus, once compressed, it will be very lightweight.

During a scan, this file will be analyzed by the antivirus as long as it supports the analysis of compressed files (which is the case for almost all antivirus programs today). To do this, the antivirus will have to extract the archive into a temporary area in order to analyze them one by one. Therein lies the problem: when this file is extracted, several gigabytes of data need to be extracted and copied into that area. This decompression process consumes all the temporary memory allocated to it, creating a denial of service (or DoS) by monopolizing all of the processor's resources.

However, some antivirus programs are capable of recognizing decompression bombs before they are decompressed.

Complex bomb
A complex bomb is a compressed file whose header is incorrect.


Simple bomb with a series of files
This bomb is actually several identical bombs nested within each other. Some compression formats allow the same file to be compressed many times within a single archive without increasing the final size of the archive. Therefore, several thousands or even millions of simple bombs can be compressed into a compressed file, and the size of the final bomb will differ little from that of a single simple bomb. The size of the files decompressed when the bomb explodes can then reach several hundred petabytes.

An example of this type of bomb is the file 42.zip, a 42-kilobyte ZIP file, which contains a file of 4.3 gigabytes repeated 165 times (in groups of 16 over 5 levels of depth), totaling 4.5 petabytes after decompression[1].


Other bombs [edit]
This problem affecting all types of compressed files allows for the creation of image bombs (picture bomb: a single pixel is repeated on an image of several thousand pixels across).

DO NOT TOUCH THIS FILE: DELETE IT DIRECTLY!!!!!!!!!!!!

--
Can you overclock your brain?

For Markita: what's your problem?
Why ask what to do, when the forum already provides possible solutions?
Why do you believe that having Windows Vista will radically change the way to solve this problem?...
You overly think that fixing Windows is a daily challenge, requiring constant questioning every fifteen minutes...
--
Can we overclock our brains?

There is a simple and effective solution: leave the file where it is without deleting it and even less modifying it because as long as the file is not open, there is nothing to fear.

jackayak I have exactly the same problem... Has anyone found a solution since that last message? Thanks in advance :)

A jackayak, I would have replied that it was better to disable system restore before considering a scan or repair. But, well... by now I hope he has found a solution!
As for you, Max, whose recent post I just read, I would rather advise you to give up using the Google Desktop bar; we all know too well the security vulnerabilities that these gadgets introduce (wondering if that’s not the intended purpose!).
And for a worry-free use of your PC, think about Linux (for example, Ubuntu). You'll see, things change and you practically won’t need any antivirus. Be careful, I didn’t say it’s useless to protect yourself, but a well-configured firewall and you’re good to go!

Stop worrying about such trivial things. It's not necessarily a virus.

A decompression bomb is NOT a file infection. It’s just Avast’s way of indicating that the file contains hidden subfiles to improve compression. However, their extraction is too heavy for Avast (sometimes even for Windows, which "freezes" the application!).
1. Open your scan report
2. Open the desktop explorer (icon completely on the left of the taskbar, or Windows button on the keyboard)
3. Position (POSITION!) the mouse over the file label "bomb" in the scan report (to make the full address of this file appear)
4. Write the address in the explorer (which is still open since you only moved the mouse without clicking anywhere) e.g.: C:\Users\Machin\Temp...etc
5. Right-click on the file (there can only be one since the address is fully marked) that the explorer returns to you
6. Left-click on "Open file location"
7. Delete if you do not recognize the file. If you know it and use it, there’s no need to delete it. Decompression bombs are definitely not dangerous, just sometimes annoying due to the freezing of the application they may cause. This freeze does not affect your computer at all.

The same goes for the .ZIP file, whose inability to be scanned is more often due to the fact that they are generally password-protected, which Avast, of course, does not know (for now, maybe in a future update they will give us the possibility to enter the passwords of files that it cannot open for this reason).