Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Is real-time AV necessary using a Virtual PC?


  • Please log in to reply
9 replies to this topic

#1 Union_Thug

Union_Thug

    Bleeps with the fishes...


  • Members
  • 2,355 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:is everything
  • Local time:05:34 AM

Posted 30 April 2011 - 08:02 AM

Hi all. I'm running guest Windows XP SP3 in VMWare player w/1gb RAM allocated, Win 7 Home Prem SP1 Host w/4gb RAM. I mostly use the guest to test software/settings/tweaks...etc not much for browsing until now. I'm testing FF v 4 in my guest OS along with themes, add-ons, etc. until I find the right combo. I have SpywareBlaster, MVPS hosts Adblock Plus, MBAM & SASW installed in both the guest & host, OS & progs are always fully patched. (I use Secunia PSI, FileHippo UDC) Since I'm spending more time browsing with the VPC, should I/ do I need an active real-time AV? Would the FF add-on NoScript be sufficient? (tried it before and found it to be a HUMONGOUS hassle building Whitelist/Blacklist & canned it) Using Avast 6 Free in host OS.

Thoughts, facts & opinions?

Thanks
"Thug"

Edited by Union_Thug, 30 April 2011 - 08:05 AM.


BC AdBot (Login to Remove)

 


#2 The Stig

The Stig

  • Members
  • 15 posts
  • OFFLINE
  •  
  • Local time:04:34 AM

Posted 30 April 2011 - 09:03 AM

I would say yes. A running AV is a good thing to have.

A bit of topic@ Is it a good thing having the ram Gb size over the recommendations ?

#3 Broni

Broni

    The Coolest BC Computer


  • BC Advisor
  • 42,697 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Daly City, CA
  • Local time:02:34 AM

Posted 30 April 2011 - 10:38 AM

Short answer....yes, you need AV program on virtual partition.

My Website

p4433470.gif

My help doesn't cost a penny, but if you'd like to consider a donation, click p22001735.gif


 


#4 Union_Thug

Union_Thug

    Bleeps with the fishes...

  • Topic Starter

  • Members
  • 2,355 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:is everything
  • Local time:05:34 AM

Posted 30 April 2011 - 06:17 PM

Thanks guys, I installed Avast this morning. I suspect I already knew the answer, but wanted to hear opinions, thoughts etc from some Bleepers. Not too many opinionated people reading this forum I guess.:whistle:

Is it a good thing having the ram Gb size over the recommendations ?

Dunno. :crazy: I installed XP from a slipstreamed & nLited CD from my old Dell 2200 laptop, which before I upgraded RAM to 1.25 GB (max supported) had only 512 mb and had performance issues with the "stuff" I had installed using only 512 mb. I adjusted the RAM in the VM today to recommended level (512mb) w/ no noticeable difference.

#5 Broni

Broni

    The Coolest BC Computer


  • BC Advisor
  • 42,697 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Daly City, CA
  • Local time:02:34 AM

Posted 30 April 2011 - 06:20 PM

Don't forget about firewall being on, as well.

512MB dedicate to virtual partition will be fine.
You don't want to go too high, or your parent partition will become slow.

My Website

p4433470.gif

My help doesn't cost a penny, but if you'd like to consider a donation, click p22001735.gif


 


#6 Union_Thug

Union_Thug

    Bleeps with the fishes...

  • Topic Starter

  • Members
  • 2,355 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:is everything
  • Local time:05:34 AM

Posted 30 April 2011 - 07:49 PM

Don't forget about firewall being on, as well.

But of course. Thanks again, Broni. :thumbup2:

Edited by Union_Thug, 30 April 2011 - 07:49 PM.


#7 Broni

Broni

    The Coolest BC Computer


  • BC Advisor
  • 42,697 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Daly City, CA
  • Local time:02:34 AM

Posted 30 April 2011 - 07:51 PM

Just checking.....:)

My Website

p4433470.gif

My help doesn't cost a penny, but if you'd like to consider a donation, click p22001735.gif


 


#8 Didier Stevens

Didier Stevens

  • BC Advisor
  • 2,685 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:11:34 AM

Posted 01 May 2011 - 03:50 AM

Yes, if you are using that VM as a normal machine, you also need AV, firewall, ... In short, protect it like a physical machine.

I do that with most of my VMs, but I also have a couple of lab VMs were an AV would interfere with my tests, so those machines are not protected. But they are also not connected to the network, and I've a snapshot to rollback to.

Edited by Didier Stevens, 01 May 2011 - 03:50 AM.

Didier Stevens
http://blog.DidierStevens.com
http://DidierStevensLabs.com

SANS ISC Senior Handler
Microsoft MVP 2011-2016 Consumer Security, Windows Insider MVP 2016-2019
MVP_Horizontal_BlueOnly.png

 

If you send me messages, per Bleeping Computer's Forum policy, I will not engage in a conversation, but try to answer your question in the relevant forum post. If you don't want this, don't send me messages.

 

Stevens' law: "As an online security discussion grows longer, the probability of a reference to BadUSB approaches 1.0"


#9 Union_Thug

Union_Thug

    Bleeps with the fishes...

  • Topic Starter

  • Members
  • 2,355 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:is everything
  • Local time:05:34 AM

Posted 01 May 2011 - 05:34 AM

Yes, if you are using that VM as a normal machine, you also need AV, firewall, ... In short, protect it like a physical machine.

Ahh, The Esteemed Mr. Stevens. Long time no see my friend, how are you?

Up until recently I hadn't been using VM as a normal machine as you put it, mostly for testing progs, software, etc. but mostly for testing updated nLite slipstreamed installation CD's for myself and family/ friends, nothing dodgy like going to questionable sites, installing dodgy software, etc...often for short periods of time. I also tested a few free & trial AV's, ASW's & FW's such as ESET NOD32, Kaspersky, WinPatrol & OA FW--usually on "fresh" installs.

@Broni: :thumbup2:

Edited by Union_Thug, 01 May 2011 - 05:47 AM.


#10 Didier Stevens

Didier Stevens

  • BC Advisor
  • 2,685 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:11:34 AM

Posted 02 May 2011 - 04:40 AM

Doing fine, hope you are fine too.

If you use your VM to test software (to later, possibly use on your physical machine), I recommend you install the same AV you have on your physical machine.
This way you can detect potential conflicts between the software you are testing and your AV. The probability of conflicts is higher when testing security software.

Didier Stevens
http://blog.DidierStevens.com
http://DidierStevensLabs.com

SANS ISC Senior Handler
Microsoft MVP 2011-2016 Consumer Security, Windows Insider MVP 2016-2019
MVP_Horizontal_BlueOnly.png

 

If you send me messages, per Bleeping Computer's Forum policy, I will not engage in a conversation, but try to answer your question in the relevant forum post. If you don't want this, don't send me messages.

 

Stevens' law: "As an online security discussion grows longer, the probability of a reference to BadUSB approaches 1.0"





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users