What is a decompression bomb

Question

Level 1

0 points

What is a decompression bomb

I just downloaded avast! and completed a scan. It showed this on the scan:

/System/Library/PrivateFrameworks/MediaKit.framework/Versions/A/Loaders/MKDriver s.bundle/Contents/Resources/bootroot.loader|>bootroot.loader.dmg

I know how to get into the system files with shift+command+g to investigate this futher, but it I can't find a PrivateFrameworks folder.

I basically have 2 questions about this.

1. Is this something I should be worried about?

2. If it is something I should worry about, how do I get to the PrivateFrameworks folder to delete it?

Thanks.

iMac (27-inch Mid 2011), OS X Mountain Lion (10.8.2)

Posted on Jan 3, 2013 3:54 AM

Reply

Answer 1

Best reply

mende1

Level 10

93,538 points

Jan 3, 2013 3:57 AM in response to jhersl74

Uninstall it. It could be a "false positive". Instead, download ClamXav and run a scan. If it doesn't show anything, ignore this file. I have that file on my Mac and it's not malware, so I think there's nothing to worry about this file

Reply

Answer 2

jhersl74 Author

Level 1

0 points

Jan 3, 2013 4:26 AM in response to mende1

Thanks. I think I should have done some more reading before I downloaded an antivirus program. What I've gathered from your answer and other forums is that is best not to use any program except for ClamXav on a Mac as all of the other ones just unnecessarily slow down the system and don't really provide anything that isn't already built into the software updates. ClamXav did not give the same false positive that Avast! did.

Reply

Answer 3

mende1

Level 10

93,538 points

Jan 3, 2013 4:28 AM in response to jhersl74

Generally, we don't recommend the use of an antivirus in OS X because they are useless. There is only one case where I recommend an antivirus, and it's when you use your Mac to copy files to USB drives that you will connect to PCs, because your Mac can transfer viruses. Also, another good antivirus for OS X is Sophos

Reply

Answer 4

WZZZ

Level 6

13,220 points

Jan 3, 2013 5:17 AM in response to jhersl74

Hallo,

42110 means "decompression bomb", and the package simply reached the limit where it has suspiciously high compression ratio.

It's fair to warn about this (some malware programs used decompression bombs to overload antivirus processing), but in few cases this might be natural consequience of highly "packable" content. dmg might be the case.

regards,

pc

https://forum.avast.com/index.php?topic=48867.0

You can ignore it. It's just a highly packed archive.

http://forum.avast.com/index.php?topic=99361.msg792334#msg792334

Reply

Answer 5

MadMacs0

Level 5

5,221 points

Jan 3, 2013 1:20 PM in response to jhersl74

jhersl74 wrote:

I just downloaded avast! and completed a scan. It showed this on the scan:

/System/Library/PrivateFrameworks/MediaKit.framework/Versions/A/Loaders/MKDriver s.bundle/Contents/Resources/bootroot.loader|>bootroot.loader.dmg

This is exactly why I have been recommending against using any of the formerly Windows only A-V software that suddenly showed up in the Spring. They truly don't understand OS X yet. That file is clearly part of the system software and deleting it would certainly break something and might even make it unusable. There are plenty of A-V vendors out there that have been with OS X since the beginning which should always be considered first. That's assuming your habits require any protection over and above what's already available on modern Macs.

Reply