Tech Outpost

[dickevans Super RootKit Eradicator]

DaveH,

Thanks for the information. I did not kow for sure and I haven't found an answer elsewhere so I made my suggestion. Your response has saved that user the effort of trying and failiing, again thank you.

[huwyngr Norton Fighter]

Thanks Dave,

I really was pretty certain that I'd come across this explanation in enough other places that it needed clarification here.

I'm still hoping that Norton will jump in on the specific of activation in view of the situation as it was left in the earlier private discussion.

[DaveH]

It has been clarified, a virtual machine is a different hardware platform than the physical system.

That makes it a different computer, it does not matter that it's running inside a program (virtual pc) that is installed on the physical system.  The "BIOS" and therefore the "motherboard" are virtulized and so are the hard drive controllers, hard drives, sound card, CD-Rom, and even the ACPI.   The "Network adapater"  although it appears to be the phyical NIC actually works through a "bridge". 

You can verify this with an activated version of windows, if you restore an image even an image of the physical OS into a VM it's going to prompt for activation because the hardware enviroment is completely different.

I'm saying this from experiance, I have personally done each and every thing I have commented on here.

I have been using virtual PC's for many years and I think I have around 15 of them at the moment.

Dave

[huwyngr Norton Fighter]

There is a point that in private discussions was left up in the air -- it's not to do with physical reality so I don't want to discuss it in public until it is clarified.

[nikki605 Super Contributor]

Well, I had no idea my question would prompt so many replies. Thanks for all the input. Your posts made for some interesting reading and I learned a few things.

After a busy day working on the "honey-do" list, I had some time this evening to test the EICAR file.  I started the VM and then started IE8 in it.  I downloaded the file from the EICAR site and low-and-behold, NIS running in the host Win7 OS saw and blocked the download.  It never got as far as even being seen by MSE running in the VM.

I guess that answered my question.  It seems I do not need to install NIS in the WinXP VM.  I probably don't even need MSE, but since it's free, I guess I'll leave it there and running.

Thanks again for all your input,

Gary

[dickevans Super RootKit Eradicator]

---

nikki605 wrote:

Well, I had no idea my question would prompt so many replies. Thanks for all the input. Your posts made for some interesting reading and I learned a few things.

After a busy day working on the "honey-do" list, I had some time this evening to test the EICAR file.  I started the VM and then started IE8 in it.  I downloaded the file from the EICAR site and low-and-behold, NIS running in the host Win7 OS saw and blocked the download.  It never got as far as even being seen by MSE running in the VM.

I guess that answered my question.  It seems I do not need to install NIS in the WinXP VM.  I probably don't even need MSE, but since it's free, I guess I'll leave it there and running.

Thanks again for all your input,

Gary

---

Gary,

Thanks for the feedback. We all learned a bit or two.

Hope your honey do isn't as long as mine.

Please do leave MSE on the VM system. Keep both Norton and MSE current. No one security program is going to protect you from every threat all of the time. That's just one of the hard facts. Security is always trying to catch up and out guess the bad guys/gals but that isn't always perfect.

Stay well and surf safe

[nikki605 Super Contributor]

The "honey-do" list is written on legal sized paper - 2 columns - both sides.

I plan on leaving MSE right where it is.  I do very web little surfing from within the VM.  I mainly have it to run Windows Live Mail for compatibility with my primary PC which is a WinXP desktop.  WLM under Win7 is not compatible withWLM under WinXP, so I have to run WLM in the VM.  Clicking on a link in an email therefore, starts IE8 in the VM.

[huwyngr Norton Fighter]

Nikki,

You can get infected from webmail ..... so IMO you need a security program on your VM if only to deal with the malware a user unwittingly can invite in.

[DaveH]

They don't get blocked for me, you can see the 3 Eicar test files on the right.

I can download and run them in VPC without Norton blocking or detecting them.

Dave

[DaveH]

I can see whats going on now.

Your using the network setting: Shared Networking (NAT)

That sets up something very similar to internet connection sharing.  All the internet traffic is coming from the internet to your physical network adapter and then goes to your virtual pc and virtual NIC through internet connection sharing.

Internet > Real NIC > internet connection sharing > Virtual PC

The internet traffic passes through your physical system and can be inspected by file insight.

I set mine for NAT and the eicar files get detected too.

I normally don't use NAT, as in the screenshot above all my VPC's are set to the physical adapter.

Internet > Virtual PC

Whats called a "bridge" is used to allow 2 systems to share a single NIC directly by letting them "take turns" using the NIC as traffic is needed. Basically 2 direct internet connections without having to use NAT.

Since there is no NAT and no traffic going through the host operating system, nothing can get inspected or blocked.

The main reason I don't use NAT is that I can set each VPC as a fixed IP address and it's easier to network them together and through a router when they are all treated as seperate systems like that.

I'm not using them as "XP Mode", I'm using them as complete virtual PC's.

Dave