^^ I don't protect my computer using a virus protection software. I only keep the latest service packs and patches (for XP) installed. I do all the web browsing and any internet activities on virtual machines. So if the virtual machine gets infected (which happens quite frequently actually), I either revert back to one of the previous (stable) snapshots of the virtual machine or dump the virtual machine all together. The virus and/or spyware and trojans never ever propogate down to the main computer when originating from a VM.
great idea, cant see it failing other than that some malware now detect honey pots, usually virtualised and so will viruses if they already dont. If so leave the machine alone. How would you trust a download?
great idea, cant see it failing other than that some malware now detect honey pots, usually virtualised and so will viruses if they already dont. If so leave the machine alone. How would you trust a download?
Even if a honeypot is detected by the virus, all it will do is leave the VM alone. I still don't see how it can propagate to the main system. How do I trust a download? Well sometimes you have to. When really concerned, by running it on the VM first and carefully analyzing the network traffic it can produce. You can also disconnect the VM from the network altogether without ever touching any cables. Running a new download in a disconnected VM is your best bet and the safest approach in my mind.
Even if a honeypot is detected by the virus, all it will do is leave the VM alone. I still don't see how it can propagate to the main system. How do I trust a download? Well sometimes you have to. When really concerned, by running it on the VM first and carefully analyzing the network traffic it can produce. You can also disconnect the VM from the network altogether without ever touching any cables. Running a new download in a disconnected VM is your best bet and the safest approach in my mind.
I accept a VM or any other sandbox will prevent propagation into network. Let's say you download a copy of norton ghost or a virus scanner. Malware is clever enough to detect the VM. You give it a test, well it seems ok provided it can run inside a VM. Install it on your system and all goes tits up.
I accept a VM or any other sandbox will prevent propagation into network. Let's say you download a copy of norton ghost or a virus scanner. Malware is clever enough to detect the VM. You give it a test, well it seems ok provided it can run inside a VM. Install it on your system and all goes tits up.
Well, other than the Photoshop and some other (legal) resource intensive programs acquired from reliable sources, I run everything on VMs. For example, I have a VM for my Dot Net 2005 development, one for Dot Net 2003, one for Visual Studio 6, one with just SQL Server, etc. This practice keeps my main machine very clean. I carry VMs between work and home easily. It doesn't get any better than this.
I am a firm believer of VMs and I think that it is one of the best recent things that ever happened in the industry. I have worked with big companies who have replaced their entire QA labs with 30+ computers (where they certify their products on different environments, OS, etc) by a couple of physical machines running several different virtual machines. Those companies were very reluctant in the beginning to use VMs in production environments but the trend has been recently increasing to do that too.
So to answer your question, running a newly downloaded program on the main machine hardly ever comes up.
Another thing you could do to protect your host PC even more is run all VMs on a separate subnet and then have one of those linux based firewalls in a VM and route everything thru there. That would make the host PC bomb proof (atleast as far as worms and them are concerned).