Author Topic: Avast and a Virtual Machine?  (Read 6380 times)

0 Members and 1 Guest are viewing this topic.

Tobias4051

  • Guest
Avast and a Virtual Machine?
« on: February 09, 2012, 12:51:05 AM »
Hi,

I'm curious about a 'virtual machine' as an extra layer of security, but I'm not sure if it will be something you need a technician to set up, if it will work well with security software, or how much it helps in preventing malware getting on the computer.

Does Avast work OK with a virtual machine, are there any complications or issues?

The guy in the local PC shop says a VM might help, but that the VM software is expensive to buy, is that so in your opinion?
He also said it's a bit like having a dual boot, and it can use a separate operating system. Does it have to use it's own OS or is that just an option?

Many Thanks.
« Last Edit: February 09, 2012, 12:53:58 AM by Tobias4051 »

Offline polonus

  • Avast √úberevangelist
  • Probably Bot
  • *****
  • Posts: 33634
  • malware fighter
Re: Avast and a Virtual Machine?
« Reply #1 on: February 09, 2012, 01:27:33 AM »
Hi Tobias4051,

Have no problems with sandboxie. But why having layer on layer. Avast asks you to open PUPs for instance inside theiir own avast sandbox. GoogleChrome is sandboxed and can also be run "sandboxed" via sandboxie. Do not forget to empty the sandbox after the session. You should run inside a virtual environment when handling material that you expect to be malcode. But anyone that wants to do that, just uses a machine in lab settings and not connected to the Internet. You always run the risk of malcode escaping from the sandbox. Notorious for these escapes are race condition bugs, the outcome of such conditions could not be predictable. Therefore they could be that dangerous. A hole in the GoogleChrome browser sandbox depended on such a race condition with the audio handling. They had to address that bug. I rather would opt for "cold reconnaissance", analyzing through a third party site/scanner, and never actually visit a suspicious site to go to the code there.
Infections while going to the actual code can fully pass under the anti malware software radar, and can be rather difficult to cleanse. After getting an alert inside a browser, sandboxed or not, always go to the browser folder and do a complete scan (remnants of the incident may be stored in the browser cache or history files, and should be quarantined). Close the browser using ctr+alt+del and do not try to click your way out of it.  Be cautious and stay safe and secure,

polonus
Cybersecurity is more of an attitude than anything else. Avast Evangelists.

Use NoScript, a limited user account and a virtual machine and be safe(r)!

Tobias4051

  • Guest
Re: Avast and a Virtual Machine?
« Reply #2 on: February 09, 2012, 02:03:55 AM »
Thank you for all the info, that is very helpful.

What about the Avast sandbox with an upgraded version of Avast?

Is there not a chrome type browser built into the internet security version of Avast that works a bit like a reverse sandbox, not letting malware on the computer affect the page, does it also work like a sandbox at the same time?
Does this help with the 'man in the browser' attacks I hear about on the news?  I'm not sure if Avast was one of the security products tested against these attacks, or if it was, what settings they used.

Quote
You should run inside a virtual environment when handling material that you expect to be malcode.
I half expect malware when visiting websites. I'm careful which sites I use, but it's still around. I'm looking at different ways to prevent infection, as I think it is better to prevent issues than trying to find and cure them.

BTW is there a security risk in family sending photos on CD?  Can malware be spread through image files if their machine is possibly infected?

Thanks.

Gargamel360

  • Guest
Re: Avast and a Virtual Machine?
« Reply #3 on: February 09, 2012, 02:15:54 AM »
I'm not sure if it will be something you need a technician to set up,
Not at all, it is fairly simple.  At least, the 2 VM programs I have messed with (VMware&VirtualBox) are.
Does Avast work OK with a virtual machine, are there any complications or issues?
Depends on what you mean....inside the VM (Guest) or outside (Host).  Installed on a host, sure, it is just as normal.  Installed in a guest, you might possibly run into problems with parts of Avast! that use sandboxing.
The guy in the local PC shop says a VM might help, but that the VM software is expensive to buy, is that so in your opinion?
VirtualBox is free.
He also said it's a bit like having a dual boot, and it can use a separate operating system. Does it have to use it's own OS or is that just an option?
A VM creates a folder on whatever OS you are running.  This folder is for all intents and purposes a blank HDD.  It does not run its own OS....it needs you to decide what to install on it.  In the case of wanting to create a Windows VM, that of course involves purchasing an OS install disc if you do not have an old one lying around.   

Its not as efficient (resource-wise) as a dual-boot, since the Guest needs the Host running to stay on.

As to whether they will protect you from all infections, no, not even if you install a Linux VM are you completely safe.  The Host and Guest are networked together, and you might like the Shared Folders option when you see it, that lessens the security again some.   But it is a very effective additional layer.

Gargamel360

  • Guest
Re: Avast and a Virtual Machine?
« Reply #4 on: February 09, 2012, 02:26:22 AM »
What about the Avast sandbox with an upgraded version of Avast?
Thats also a good option and is more simple and user-friendly than a full VM.
Is there not a chrome type browser built into the internet security version of Avast that works a bit like a reverse sandbox, not letting malware on the computer affect the page, does it also work like a sandbox at the same time?
You think of SafeZone, it is like a reverse-sandbox that uses an Avast!-maintained Chromium browser.  I've never used it, but if you gave the free trial a spin, and installed a keylogger for example, then used SafeZone, the keylogger would be unable to record what happens.   It is separate from the normal Avast! Sandbox that also comes with paid versions.  The normal Sandbox is meant to help prevent infections from occurring in the first place, for your everyday browsing.  SafeZone is a "just-in-case" guard for anything you would consider "confidential", mostly financial transactions or personal data.

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67241
Re: Avast and a Virtual Machine?
« Reply #5 on: February 09, 2012, 02:53:42 PM »
VMware is shareware and VirtualBox is a freeware.
Both work fine. VirtualBox also adds snapshotting, what makes tests even easier.
avast works on both.
The best things in life are free.