Go back
Running Avast in boot mode, found this file:

Running Avast in boot mode, found this file:

General

Vote Up
Vote Down

Python-2.6 MSI error 42110 (this file is a decompression bomb)

Anyone ever hear that term 'decompression bomb' before? And what it means if you have?

Vote Up
Vote Down

Originally posted by sonhouse
Python-2.6 MSI error 42110 (this file is a decompression bomb)

Anyone ever hear that term 'decompression bomb' before? And what it means if you have?
I think it has something to do with scuba diving.

Vote Up
Vote Down

Originally posted by Great Big Stees
I think it has something to do with scuba diving.
😀

2 edits
Vote Up
Vote Down

Originally posted by sonhouse
Python-2.6 MSI error 42110 (this file is a decompression bomb)

Anyone ever hear that term 'decompression bomb' before? And what it means if you have?
http://www.ehow.com/facts_5582981_decompression-bomb_.html

Rather nasty I'd say.

Edit: And this, from the Avast! forums:

http://forum.avast.com/index.php?topic=8943


Edit: The thing is, Avast! seems particularly adept at finding these. A lot of the entries for decompression bombs on search engines also bring up the Avast! name.

Vote Up
Vote Down

Originally posted by Suzianne
http://www.ehow.com/facts_5582981_decompression-bomb_.html

Rather nasty I'd say.
Ooops, not so funny at all. 🙁

Vote Up
Vote Down

jeez, sonhouse, where'd you pick that up? let the kids loose on the comp again?

Vote Up
Vote Down

Did you ever download the Python installer? This may actually just be a false-positive.

I'd suggest before you take any drastic action that you compare the MD5 hash on the Python website with the files' hash to see if it is legit.

Here a checksum 'checker' that integrates into the Windows shell, giving you the hashes and checksums in the file properties dialog. http://code.kliu.org/hashcheck/

Vote Up
Vote Down

Originally posted by Crowley
Did you ever download the Python installer? This may actually just be a false-positive.

I'd suggest before you take any drastic action that you compare the MD5 hash on the Python website with the files' hash to see if it is legit.

Here a checksum 'checker' that integrates into the Windows shell, giving you the hashes and checksums in the file properties dialog. http://code.kliu.org/hashcheck/
I tried that site but when it downloaded a message came up saying should I unzip with 'winrar' which I had installed a while ago. I don't really like winrar, I never have had good luck unzipping stuff with it. I guess I should delete it and start over. What happened was after supposedly unzipping it to the desktop, I got a bunch of non-program icons, 37 of them in fact and I went to control panel to see if I could delete that program and it was there but without a listing of the program size so I hit delete and it supposedly went through but of course all the bogus icons were still on the desktop. I hit cntl and highlighted all of them and deleted the bunch in one go which seemed to get rid of it. Should I delet that winrar and just use XP's unzip and try again or is there something else wrong?

Vote Up
Vote Down

Originally posted by Crowley
Did you ever download the Python installer? This may actually just be a false-positive.

I'd suggest before you take any drastic action that you compare the MD5 hash on the Python website with the files' hash to see if it is legit.

Here a checksum 'checker' that integrates into the Windows shell, giving you the hashes and checksums in the file properties dialog. http://code.kliu.org/hashcheck/
wut

1 edit
Vote Up
Vote Down

Originally posted by sonhouse
I tried that site but when it downloaded a message came up saying should I unzip with 'winrar' which I had installed a while ago. I don't really like winrar, I never have had good luck unzipping stuff with it. I guess I should delete it and start over. What happened was after supposedly unzipping it to the desktop, I got a bunch of non-program icons, 37 of ...[text shortened]... I delet that winrar and just use XP's unzip and try again or is there something else wrong?
WinRAR is a crap program. Get 7Zip.
It can decompress most common formats, including .rar files. You can't make RAR archives with it, but most people don't need to make native RAR archives. RAR is a proprietary format.

Also, did you maybe download the source? Download the installer, not the source code.

Vote Up
Vote Down

Originally posted by Crowley
WinRAR is a crap program. Get 7Zip.
It can decompress most common formats, including .rar files. You can't make RAR archives with it, but most people don't need to make native RAR archives. RAR is a proprietary format.

Also, did you maybe download the source? Download the installer, not the source code.
I installed both, I can read you know! Thanks for the tip about winrar. Never liked that program anyway. I think it was winrar that caused the problem. Out with the old, in with the new.

Vote Up
Vote Down

Originally posted by sonhouse
I installed both, I can read you know! Thanks for the tip about winrar. Never liked that program anyway. I think it was winrar that caused the problem. Out with the old, in with the new.
LOL, dude the source code you need to compile in order to use. Why would you download it?

1 edit
Vote Up
Vote Down

Originally posted by Crowley
LOL, dude the source code you need to compile in order to use. Why would you download it?
The only thing the link says is 'download installer' and 'download source code'.

Normally when I see download installer, I think of that as the installer only, then needing the rest of the real program to get it all. There were no other instructions on that site for getting the program running, so I assumed you had to download the source code which the installer would then finish up with the rest. I gather you figure I am a complete idiot not immediately knowing what to do. So enlighten me.

BTW, avast did not try to unzip that 'compression bomb' so it seems to have handled it ok. the CB doesn't seem to be a very useful hack if one is interested in getting private data, SS#'s, account #'s and the like. The fact that my machine is still running on low CPU #'s right now seems to indicate the CB didn't get opened.
It looks like other AV's like Trend Micro, which I also have, also does not open that kind of file, so at least some of the AV companies are on to the CB trick.

Vote Up
Vote Down

Originally posted by Crowley
WinRAR is a crap program. Get 7Zip.
It can decompress most common formats, including .rar files. You can't make RAR archives with it, but most people don't need to make native RAR archives. RAR is a proprietary format.

Also, did you maybe download the source? Download the installer, not the source code.
Who?



GRANNY.

Vote Up
Vote Down

Originally posted by sonhouse
The only thing the link says is 'download installer' and 'download source code'.

Normally when I see download installer, I think of that as the installer only, then needing the rest of the real program to get it all. There were no other instructions on that site for getting the program running, so I assumed you had to download the source code which the i ...[text shortened]... open that kind of file, so at least some of the AV companies are on to the CB trick.
Don't be so tetchy. Jeez. I've given you lots of flak before, because you do idiotic stuff sometimes. These days I'm trying to honestly help, but you gotta tone down the sensitivity.

So, for future reference, only download the source files off a site if you want to compile it yourself.


Onto business:
There's a good chance this compression bomb may have been a false-positive, but I'd suggest you just kill the file and download it again if you need it.

Please tell me you're not running more than one AV suite at once...