climateprediction.net home page
Norman Virus Control (NVC 5.8) detecting .gz archives as possible ZIP-bombs

Norman Virus Control (NVC 5.8) detecting .gz archives as possible ZIP-bombs

Questions and Answers : Windows : Norman Virus Control (NVC 5.8) detecting .gz archives as possible ZIP-bombs
Message board moderation

To post messages, you must log in.

AuthorMessage
Lars Vindal

Send message
Joined: 8 Nov 04
Posts: 3
Credit: 994,108
RAC: 0
Message 24159 - Posted: 2 Sep 2006, 21:03:40 UTC

As subject says, some of the gzip files are detected as possible ZIP-bombs. In particular, it\'s these files:

DMSNH3SO2A1B_19182082N.gz
ozone_hadcm3_1919_2082.gz
SULPC_OXIDANTS_19_A2_1990.gz

I see three possible solutions to this:
(1) Make the antivirus skip the project folder or individual files
(2) Change the internal structure of the gzip files to avoid being seen as a possible ZIP-bomb
(3) Contact the antivirus company to try resolving it on their end

I guess alternative (1) is most relevant, but could option (2) be a way to go also?
Last option could be done by me, but don\'t know how successfull it would be, since updated gzip parameter files might create the same problem over again.

Any ideas?
ID: 24159 · Report as offensive     Reply Quote
Les Bayliss
Volunteer moderator

Send message
Joined: 5 Sep 04
Posts: 7629
Credit: 24,240,330
RAC: 0
Message 24161 - Posted: 2 Sep 2006, 22:37:01 UTC
Last modified: 2 Sep 2006, 22:36:26 UTC

Been there, heard that. :)

Go for 1); skip the entire BOINC folder, both with prgrammed and \'on demand\' scanning.
Which is the standard recommended proceedure for all problem AV programs.

According to another cruncher who posted on the php board, his AV company said that a \'bomb\' is a VERY large zip file, that is too large for the program to check, so it \'gets the jitters\'. Or words to that effect.

2) is out, because then the programmers would be forever changing the structure each time an AV company come up with a new \'bright idea\'.
BOINC has already had to be changed recently to get around a problem created by a recent \'bright idea\' by, I think, Mcaffe.

ID: 24161 · Report as offensive     Reply Quote

Questions and Answers : Windows : Norman Virus Control (NVC 5.8) detecting .gz archives as possible ZIP-bombs

©2024 climateprediction.net