up vote 4 down vote favorite
2
share [g+] share [fb]

What would be the best (and most secure) virtual machine for testing files to see if they are clean?

Could I run a program and see all the threads / files that it is writing to the hard drive like how I can in Sandboxie?

What would be even better is the ability to view all network connections and be able to take snapshots of the harddrive image.

I dont want VMWare or anything too big.

Thanks, Tanner

link|improve this question
feedback

6 Answers

up vote 5 down vote

For file testing, I highly recommend you run it in a proper VM environment. VMWare is arguably the best, but it's not free, and you do not want it. To that effect, I will recommend VirtualBox then.

Advantages of VirtualBox :

  1. Open Source, and Free
  2. Supports snapshots
  3. Low overheads
  4. Functions just like another computer (you can run your proc monitors and any other diagnostics tools you want)
  5. Entirely separated from the host computer if you disconnect the virtualized network
  6. Smaller than VMWare (300MB for VMWare vs 70MB for VirtualBox download sizes)
link|improve this answer
1  
VMWare server is free! – benPearce Sep 9 '09 at 5:22
Not suitable for a testing environment - e.g lack of multiple snapshots functions. virtualization.info/lab/VMwareWKS60_vs_VMwareSVR10.pdf – caliban Sep 9 '09 at 5:35
Vmware lack now of plenty of features that VirtualBox now ... Open Source developpement is so faster than regular developpement that a free or paid software could not stand a lot of time against an open source software but developpers choose their ways to make their software sometime not like you hope but most of the time, open source powned most of free and paid softwares that I used before ... Free and Paid softwares seem outdated compared to most open source softwares ... – zillion Sep 9 '09 at 5:51
+1 for VMWare and VMWare Server. – Optimal Solutions Jan 17 '10 at 15:34
If you've got a dedicated machine, VMware's ESXi is very nice, and it's also free. It's got tiny host overheads - it's running Busybox which uses almost no resources. – Dentrasi Jan 17 '10 at 17:13
feedback
up vote 0 down vote

I've used iCore Virtual Accounts in the past. It creates sandboxed user accounts in it's own virtual machine type setting, although it virtualizes your existing kernel without the need for serials and activations. It doesn't feel as clunky as a full blown VM so I'd give it a try . You can use it along with Process Explorer to see the behavior of the file.

link|improve this answer
feedback
up vote 0 down vote

My local test environment runs VMware Server 2.0 on a modest 8G Dell Optiplex workstation (about $500). I have ~20 nodes, running a variety of operating systems and software environments (mainly for testing our software), and don't have any issues.

VMware has the benefit of being widely adopted, with a variety of free and commercial products, which means that creating a machine image you can use on other systems is simple, and portable.

link|improve this answer
feedback
up vote 0 down vote

I go with Virtual PC, the new version for Windows 7 is great as long as you have hardware support.

link|improve this answer
feedback
up vote 0 down vote

Try to use iCore Virtual Accounts (http://icoresoftware.com/). This program allows you to run programs separetely and safety for your host system.

link|improve this answer
feedback
up vote 0 down vote

There are some good recommendations in the other answers here regarding specific products but you will also want to make sure that you are doing your best in terms of VM configuration to prevent any potential malware detecting the fact that it is running within a Virtual Machine as quite a lot of the more advanced attack code will behave differently if it detects that it is being sandboxed. Alain Zidouemba at the Sourcefire VRT team posted an excellent blog entry about this last year with specific reference to VMware VM's but much of the advice applies to using other VM environments.

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard