5

I have Windows 7, and installed virtualbox on it with a copy of Windows XP pro sp3 with all updates. I want to use the virutal environment to practice removing malware....in other words, I want to infect it on purpose. What is the safest way to do this so that win 7 doesn't get infected as well? Any settings I should change in virutalbox?
And before anyone asks, no, I don't write viruses/malware. I am a tech, and would like to practice removing malware.

Thanks.

1

7 Answers 7

3

A noble but misguided endeavor. I used to keep up with the latest techniques for this, but that's not really best practice anymore. Once a system is infected with malware, you just can't trust it again. The right thing to do is back up what data you can, clean that data in a safe environment, and then rebuild the system from scratch (format the drive and re-install the operating system).

1

I wouldn't have any shared folders b/t the host and the guest OS. I also wouldn't set up the VM to use NAT (where it just uses the host's NIC instead of a virtual one, so it looks like any traffic is coming from the host. I think I've read this can also lead to other problems with spreading the malware). If you have the resources, I'd put the VM on a box you didn't care much about, or at least backup all data in case it does get into your host OS.

If you're doing this from work, I would have it in writing from your managers and anybody else that would be involved in the network policy that you have permission to do this. This is a very good example of CYA. You'll probably need to go to some non-approved sites to get the malware, plus you don't want whoever handles network security to come freaking out because something got hacked.

1

If you need viruses, see the Eicar anti virus test file.

My advice is not only not to allow an infected machine in your network, but not to define it with a network controller. Once infected, the virtual-pc console should be your only interaction with the machine. Absolutely no file transfer, neither in nor out.
Don't dare use a real machine, because some viruses install themselves in the BIOS, so you'll never get them out. For the same reason, delete afterward the infected machine - don't keep it around.
Beware: The latest viruses have begun perfecting methods for breaking-out of virtual machines.

2
  • 1
    got a link to the virus breaking out of a VM? sounds interesting
    – basszero
    Sep 1, 2009 at 19:51
  • Foe example see "VMWare flaw allows guests to break out" at securityfocus.com/brief/688. Who knows how many such undisclosed (or unknown) vulnerabilities exist.
    – harrymc
    Sep 2, 2009 at 8:21
1

Go and download a whole load of keygens from one of the less reputable sites, and you'll not be far off. Browsing around 'free' porn sites using IE 6 with no AV is another good method. You could also access your webmail, and click all the spam links.

Once you've got it heavily infected, take a snapshot, so you can test different looks against it.

1

Best bet is to use a throw-away, stand-alone PC. Install XP on it and then create a backup image using DriveImageXML or Macrium Reflect (both free). PLay around with infections and when you're done, copy the image back over and play some more. That's how we do it in my shop.

0

Disable the network (right click > disconnect on the NIC icon) and shared folders and you should be safe, also to be even safer i would choose a linux or mac host.

Jim

0

I would create an image of the windows XP after install so you can always reinstate it and be fresh.

Also you can look on malwaredomainlist.com for some of the latest reported malware.

Although I wouldn't suggest learning in this way. Maybe enrolling for free at malwareremoval.com. The course there is one of the best but it is long and rigorous but well worth it if you have the time, and its much safer.

You must log in to answer this question.