NoOp wrote:
> On 02/03/2009 12:40 PM, NoOp wrote:
> [snips]
>> I scan my vdi using clamav & BitDefender (linux version) occassionally.
>> However I don't know if they are effective as I've never had an infected
>> guest (I run Win2KPro as the guest). But it's a good question; I'll add
>> some virus signatures on my guest, scan with both & let you know what
>> the result are :-)
> 
> Results:
> 
> Well... the results are that neither detect a virus signature in the
> vdi. I downloaded the eicar test sigs [1] & first tested on my linux
> system w/clamav and bitdefender; both found and identified teh test
> virus signature. I then put them onto a win2kPro guest; AVG &
> BitDefender (Windows) correctly picked them up.
> 
> I then scanned the vdi (it's 6GB) with clamav and bitdefender (linux);
> neither detected eicar in the vdi. I tried it both with the guest
> running and with VirtualBox off completely.
> 
> [1] http://www.eicar.org/anti_virus_test_file.htm
> 
> 
> 
> _______________________________________________
> vbox-users mailing list
> [email protected]
> http://vbox.innotek.de/mailman/listinfo/vbox-users

This is loosely related to another question a few days ago about mounting a VDI
directly outside of a VBox. I think the answer is that at the moment a VDI could
be thought of as an 'encrypted' copy of a hard disk, and so the data on it is
essentially hidden from any program reading the VDI. The same would hold for any
encrypted file - a virus scanner would not (correctly) spot a virus signature,
although there is a change that some of the bytes in the encrypted version could
match a know virus sig.

I'm currently working on improving my original solution to the problem of
viewing VDIs outside of VBox - I ran a Vbox using a lightweight Linux distro on
a live disk image (a Damn Small Linux ISO works quite well) and then mounting
the VDI as a hard drive to do maintenance (eg. virus scanning) on it. One major
drawback is that you can't use the VDI this way if it's still attached to
another VBox...

-- 
Peter Ford, Developer                 phone: 01580 893333 fax: 01580 893399
Justcroft International Ltd.                              www.justcroft.com
Justcroft House, High Street, Staplehurst, Kent   TN12 0AH   United Kingdom
Registered in England and Wales: 2297906
Registered office: Stag Gates House, 63/64 The Avenue, Southampton SO17 1XS

_______________________________________________
vbox-users mailing list
[email protected]
http://vbox.innotek.de/mailman/listinfo/vbox-users

Reply via email to