VHD XP Mode Question

[Goku]

I wanna use XP Mode for malware testing so I copied both VHD files and put them in a folder on my main os is that wrong? Also should I disable integration for malware testing?

 

[Night Hawk]

That could end up very easily seeing any malware spread through the main host OS. The integrated components is optional and disabling that would prevent anything from gaining access to the main drive.

Another idea if you have a second drive available to go one step further would be seeing a temp install of Windows on that as a stand alone to run the XP Mode there for testing for "bugs". That would keep all testing isolated from your main drive. If that host becomes infected you would simply nuke the drive clean to prevent any further spread while maintaining system integrity.

 

[Goku]

What's the difference between having Integration Enabled/Disabled?

 

[Night Hawk]

The integrated components supports direct access to the physical drives installed as well as usb devices like printers. While in the XP Mode itself simply open up MyComputer or any explorer window to see C for the XP Mode vhd itself then A, C, D, etc. for all other drives.

With that unavailble nothing would have any type of remote access or be copied over by you to one of the main drives. You could always delete the vhd itself to wipe out any infection on the XP Mode but then need to redownload and install that all over again since all too many bugs were aimed at XP and still are floating around.

Another suggestion is still seeing a good layer of protection inplace on the host itself as you would generally see anyways that would detect any bugs when running a system scan or when something became active if you do copy files over from the XP Mode that may have been infected. Having a working system image for the main drive as well as isolating it as much as possible would be even a better move just in case.

 

[madtownidiot]

If you want to test malware in VMs, use a linux host instead, because linux is immune to windows based malware

 

[Night Hawk]

That wouldn't test the effectiveness of any 3rd party Windows protections however if this is why this is being done. I think this is why Goku elected the XP Mode since he could install and run Windows based av and other programs.

 

[madtownidiot]

NM.. misunderstood the question.. probably because I was using vBox in a Ubuntu host to try to find an easier way to remove rogue AVs from windows xp a few hours ago while testing malwarebytes simultaneously in a 2nd VM and assumed the OP had a similar intent for some reason


http://www.sevenforums.com/system-security/111574-rogue-anti-virus-2.html