NoOp wrote: > On 02/03/2009 12:40 PM, NoOp wrote: > [snips] >> I scan my vdi using clamav & BitDefender (linux version) occassionally. >> However I don't know if they are effective as I've never had an infected >> guest (I run Win2KPro as the guest). But it's a good question; I'll add >> some virus signatures on my guest, scan with both & let you know what >> the result are :-) > > Results: > > Well... the results are that neither detect a virus signature in the > vdi. I downloaded the eicar test sigs [1] & first tested on my linux > system w/clamav and bitdefender; both found and identified teh test > virus signature. I then put them onto a win2kPro guest; AVG & > BitDefender (Windows) correctly picked them up. > > I then scanned the vdi (it's 6GB) with clamav and bitdefender (linux); > neither detected eicar in the vdi. I tried it both with the guest > running and with VirtualBox off completely. > > [1] http://www.eicar.org/anti_virus_test_file.htm > > > > _______________________________________________ > vbox-users mailing list > [email protected] > http://vbox.innotek.de/mailman/listinfo/vbox-users
This is loosely related to another question a few days ago about mounting a VDI directly outside of a VBox. I think the answer is that at the moment a VDI could be thought of as an 'encrypted' copy of a hard disk, and so the data on it is essentially hidden from any program reading the VDI. The same would hold for any encrypted file - a virus scanner would not (correctly) spot a virus signature, although there is a change that some of the bytes in the encrypted version could match a know virus sig. I'm currently working on improving my original solution to the problem of viewing VDIs outside of VBox - I ran a Vbox using a lightweight Linux distro on a live disk image (a Damn Small Linux ISO works quite well) and then mounting the VDI as a hard drive to do maintenance (eg. virus scanning) on it. One major drawback is that you can't use the VDI this way if it's still attached to another VBox... -- Peter Ford, Developer phone: 01580 893333 fax: 01580 893399 Justcroft International Ltd. www.justcroft.com Justcroft House, High Street, Staplehurst, Kent TN12 0AH United Kingdom Registered in England and Wales: 2297906 Registered office: Stag Gates House, 63/64 The Avenue, Southampton SO17 1XS _______________________________________________ vbox-users mailing list [email protected] http://vbox.innotek.de/mailman/listinfo/vbox-users
