2

I am considering using a virtual machine to isolate downloads from questionable sources until I can check them for virus' etc.

Using VirtualPC: If I set up a virtual machine on its own harddrive (separate from the host OS) how isolated is it from the host OS, and the other drives in the box -- assuming I don't map the virtual machine to the other drives and don't ?

What else should I keep in mind?

Improve this question

3 Answers 3

Reset to default
1

A network is probably the easiest way for anything malicious to access your virtualized environment, as explained here. If you plan on downloading from the virtual machine, you will likely be using a bridged connection. As soon as you use this, your virtualized hardware can be seen on the network. If you can be seen by other nodes, you are vulnerable to anything gaining access to your network. I'd suggest downloading the files and analysis tools first (anti-virus programs, process explorer, etc), then turning off your virtual machines network connection prior to testing anything. You can never be too safe.

As for putting it on different drives, it can increase your security if the malware coder wasn't very smart, but it's easy to find other available drives via the Win32 API function GetLogicalDriveStrings.

Improve this answer
1
  • 1
    In my experience NAT is more common than network bridges for VMs
    – Joey
    Oct 2, 2009 at 5:20
4

You don't have to setup a physically separate drive to isolate your VM from the host. Ways a virus could still reach your host:

  1. Any removable media you expose to the VM is a potential carrier
  2. Worms typically proagate over a network, so any machine exposed to the same network as your VM is potentially at risk - not just your host is at risk.
  3. If you do infect your VM, unless you have a snapshot that predates the infection, you have to treat the whole virtual drive as infected.
Improve this answer
1

If you're really concerned about malware, you might want to turn off the VM's networking and any shared drives before running/testing the suspect download. And either take a snapshot or back up the virtual HD before doing the download.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .