Free virtualization tool for testing suspicious files

Question

From time-to-time I test files that are possible infected from any malware. Though sometimes these are false-positives, but at times I need to extract infected archive. Sometimes I don't have another PC and want to try this risky thing on my main PC.

Firstly, how can Virtualization help in this scenario? Secondly, is there any free and reliable Virtualization tool for Windows 7?

Answer 1

Like others mention, you can use virtualization like Virtualbox to keep your specimens quarantined inside.
Problem is, it's kind of like building an isolation ward in your kid's room: it's safe and there's no chance of escape (or at least abysmal), but on the other hand it's hard to install/maintain another system (virtual or not) and your computer may occasionally whine about resource usage if you don't have 12GB of RAM in your system.

The other option is sandboxing. If virtualization is an isolation ward, then sandboxing is a playroom.
It's far easier to set up and maintain (and less mentally disturbing :-) and also has less resource usage (it's just another room), won't whine about resource usage, and lets you have the same comforts of your regular system.
Solutions like Sandboxie (shareware, $40) and Acronis True Image's "Try&Decide" feature (commercial, $30) or even the almost-dead Steadystate (free) under a Guest account (well, if you were running XP or Vista still) are all valid sandboxers.

The third option is to just send it to a virus analyzer like VirusTotal or Jotti. If your file is less than 20MB, they will open up the archive (IIRC MSI, ZIP, TGZ, and a few others) and then scan the thing using over 9000 virus scanning engines and report back with the results.

You mentioned self-extracting archives. Something like Universal Extractor might help you by extracting the files from the archive without running the installer itself. Then you can run your normal antivirus or use VirusTotal for the individual files in the archive.

Answer 2

Try VirtualBox.

Answer 3

An alternate solution that doesn't use virtualization is either Returnil or Sandboxie.

Both allow one to run software without letting it modify the operating system.
However, all changes that the program virtually effects are lost after a reboot.

Answer 4

There are a few free choices for virtualization virtualbox and virtual PC among others.

Both (all VM software?) allows you to save a state of the virtual computer. You can then test your suspicious files and then revert the virtual computer to the way it was before your test.

Answer 5

One way virtualization might help is by copying a template VM, testing the files in the copied instamce of the template VM - presumably any infection will be of the guest OS in the VM and not of the host OS. Finally delete the VM but keep the clean template.

There are many choices for virtualization software such as several basic VMware products. Since Windows 7 includes virtualisation I know of no good reason not to use that.

Answer 6

The easiest way by far is to use Sandboxie. It is free for personal use, however after a certain amount of time or number of uses you will just get a small screen telling you that while free you have to wait a few seconds for it to start running whatever application you want in sandboxed mode. There is a great tutorial here at How-To Geek that explains how to install and set up Sandboxie and also includes a link to download the program. I use Sandboxie all the time to test files of a suspicious nature.