Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

From time-to-time I test files that are possible infected from any malware. Though sometimes these are false-positives, but at times I need to extract infected archive. Sometimes I don't have another PC and want to try this risky thing on my main PC.

Firstly, how can Virtualization help in this scenario? Secondly, is there any free and reliable Virtualization tool for Windows 7?

share|improve this question
    
Several posts have suggested MS Virtual PC. One advantage to this over other solutions is that you are free to use a virtualized installation of Windows XP (via XP Mode) on any computer with Windows 7 Professional or Ultimate. If you use something like Virtual Box, you may have to purchase a Windows license to use in the virtual machine. –  nhinkle Dec 29 '10 at 5:15

6 Answers 6

up vote 4 down vote accepted

Like others mention, you can use virtualization like Virtualbox to keep your specimens quarantined inside.
Problem is, it's kind of like building an isolation ward in your kid's room: it's safe and there's no chance of escape (or at least abysmal), but on the other hand it's hard to install/maintain another system (virtual or not) and your computer may occasionally whine about resource usage if you don't have 12GB of RAM in your system.

The other option is sandboxing. If virtualization is an isolation ward, then sandboxing is a playroom.
It's far easier to set up and maintain (and less mentally disturbing :-) and also has less resource usage (it's just another room), won't whine about resource usage, and lets you have the same comforts of your regular system.
Solutions like Sandboxie (shareware, $40) and Acronis True Image's "Try&Decide" feature (commercial, $30) or even the almost-dead Steadystate (free) under a Guest account (well, if you were running XP or Vista still) are all valid sandboxers.

The third option is to just send it to a virus analyzer like VirusTotal or Jotti. If your file is less than 20MB, they will open up the archive (IIRC MSI, ZIP, TGZ, and a few others) and then scan the thing using over 9000 virus scanning engines and report back with the results.

You mentioned self-extracting archives. Something like Universal Extractor might help you by extracting the files from the archive without running the installer itself. Then you can run your normal antivirus or use VirusTotal for the individual files in the archive.

share|improve this answer

Try VirtualBox.

share|improve this answer

There are a few free choices for virtualization virtualbox and virtual PC among others.

Both (all VM software?) allows you to save a state of the virtual computer. You can then test your suspicious files and then revert the virtual computer to the way it was before your test.

share|improve this answer

One way virtualization might help is by copying a template VM, testing the files in the copied instamce of the template VM - presumably any infection will be of the guest OS in the VM and not of the host OS. Finally delete the VM but keep the clean template.

There are many choices for virtualization software such as several basic VMware products. Since Windows 7 includes virtualisation I know of no good reason not to use that.

share|improve this answer

An alternate solution that doesn't use virtualization is either Returnil or Sandboxie.

Both allow one to run software without letting it modify the operating system.
However, all changes that the program virtually effects are lost after a reboot.

share|improve this answer

The easiest way by far is to use Sandboxie. It is free for personal use, however after a certain amount of time or number of uses you will just get a small screen telling you that while free you have to wait a few seconds for it to start running whatever application you want in sandboxed mode. There is a great tutorial here at How-To Geek that explains how to install and set up Sandboxie and also includes a link to download the program. I use Sandboxie all the time to test files of a suspicious nature.

share|improve this answer
    
Sandboxie has already been mentioned by @harrymc. -1 –  studiohack Jan 5 '11 at 3:27
    
Oh You've got to be friggin kidding me...what difference does it make if someone else has already mentioned something or not? I don't see where either of the other two users who ALSO mentioned Virtual Box or Sandboxie that had already been mentioned by digitxp in the second post have been punished. What, have you got a hard on for me or something? You edit my posts because I try to be polite and say "Thank You" and now you take whatever these points are away because I offer my opinion on a piece of software and clarify its licensing setup? Sounds kinds personal to me. –  Valek Hawke Jan 5 '11 at 20:28

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.