virtualbox.org

I would like to use Virtual Box to test Malware removal techniques.
Specifically, I have created a XP PRO sp3 client which I would like to infect.
Then, I would like to boot off a Windows Ultimate Boot CD and clean-up the infections.
Is this possible?
Thank you in advance.

Shouldn't be a problem. You can either place the CD in your normal CD/DVD drive or just attach the .iso file to the VM. Then make sure the boot order for your VM is set accordingly. I would suggest isolating your guest, i.e. no networking allowed.

Etepetete wrote:Shouldn't be a problem. You can either place the CD in your normal CD/DVD drive or just attach the .iso file to the VM. Then make sure the boot order for your VM is set accordingly. I would suggest isolating your guest, i.e. no networking allowed.

I moved the CD/DVD to the top of the boot order but it still booted off the hard drive.

allanc, sorry for a stupid question: did you also:

Etepetete wrote:...either place the CD in your normal CD/DVD drive or just attach the .iso file to the VM...

?
Settings>CD/DVD-ROM>'Mount CD/DVD Drive' check on>Either 'Host CD/DVD Drive' and insert the UBCD in the host's drive, or 'ISO Image File' and select/add the ubcd image.

MarkCranness wrote:allanc, sorry for a stupid question: did you also:

Etepetete wrote:...either place the CD in your normal CD/DVD drive or just attach the .iso file to the VM...

?
Settings>CD/DVD-ROM>'Mount CD/DVD Drive' check on>Either 'Host CD/DVD Drive' and insert the UBCD in the host's drive, or 'ISO Image File' and select/add the ubcd image.

Not a stupid question at all - especially since I have only been using Virtual Box for a short time.
When I followed your instructions the Ultimate Boot CD *did* boot but the Virtual Box client drive was not visible when I ran MS Explore from the UBCD.
Here is my configuration:
1.) Dell Inspiron 1501, SATA HD, Vista Home, 2Gb of RAM.
2.) Virtual Box 3.0.8 installed
3.) Secondary SATA HD connected via USB to a NexStar Hard Drive Dock (the Virtual Box client for XP PRO sp3 is stored here).

In Virtual Box -> Settings -> CD/DVD-ROM I have 'Mount CD/DVD Drive' checked and 'Host CD/DVD Drive' is selected with drive 'E:' in the drive selector.
The System -> Boot Order is 'CD/DVD, Hard Drive, Floppy'.

The Virtual Box Client boots of the Ultimate Boot CD. The only hard drive that is visible in MS Explore (within the UBCD environment) is the internal hard drive and not the SATA HD that is connected via USB.

Etepetete wrote:Shouldn't be a problem. You can either place the CD in your normal CD/DVD drive or just attach the .iso file to the VM. Then make sure the boot order for your VM is set accordingly. I would suggest isolating your guest, i.e. no networking allowed.

RE: networking:
If I run 'IpConfig /all' on my Virtual Box Client....
I get an IP of 10.0.2.15, gateway 10.0.2.2 and a subnet mask of 255.255.255.0
The Vista host and all of the other network devices (routers, PCs) are in the 192.168.x.x range.
Am I safe in terms of the networking aspect?

I would just detach the "virtual cable" to the virtual NIC. http://www.virtualbox.org/manual/UserMa ... #id2513282. I don't know what kind of malware you want to test. In my opinion the best thing to do is to not allow any networking at all.

Etepetete wrote:I would just detach the "virtual cable" to the virtual NIC. http://www.virtualbox.org/manual/UserMa ... #id2513282. I don't know what kind of malware you want to test. In my opinion the best thing to do is to not allow any networking at all.

Do you have any suggestions as to why the external SATA drive (on USB) is not visible to the UBCD?

Calling it an "external SATA drive (on USB)" is confusing. I assume you are talking about a USB drive (the fact that it uses SATA "under the hood" doesn't matter).

So, assuming you do mean a USB drive, then I imagine you are encountering the usual problems people have getting USB drives to work reliably with a VBox VM. It would be better to wrap whatever files you need access to inside a VDI, and mount the VDI as a second drive. A network shared folder (mapped to a shared folder on the USB drive) is also a possibility, but I don't yet know how to set up a network share when I've booted off a recovery CD.

mpack wrote:Calling it an "external SATA drive (on USB)" is confusing. I assume you are talking about a USB drive (the fact that it uses SATA "under the hood" doesn't matter).

So, assuming you do mean a USB drive, then I imagine you are encountering the usual problems people have getting USB drives to work reliably with a VBox VM. It would be better to wrap whatever files you need access to inside a VDI, and mount the VDI as a second drive. A network shared folder (mapped to a shared folder on the USB drive) is also a possibility, but I don't yet know how to set up a network share when I've booted off a recovery CD.

Sorry, I am new at this but willing to learn.
Can you point me to what VDI means (in terms of Virtual Box) and how to use it?
Thanks in advance.

mpack wrote:Calling it an "external SATA drive (on USB)" is confusing. I assume you are talking about a USB drive (the fact that it uses SATA "under the hood" doesn't matter).

So, assuming you do mean a USB drive, then I imagine you are encountering the usual problems people have getting USB drives to work reliably with a VBox VM. It would be better to wrap whatever files you need access to inside a VDI, and mount the VDI as a second drive. A network shared folder (mapped to a shared folder on the USB drive) is also a possibility, but I don't yet know how to set up a network share when I've booted off a recovery CD.

I would like to clarify....
Due to space restrictions on my internal drive - the Virtual Box client image resides on the external USB drive.
I can already successfully boot off that Virtual Box client.
What I am trying to do is boot off the UBCD and access the XP PRO sp3 Virtual Box client which resides on that USB drive.

allanc wrote:Can you point me to what VDI means (in terms of Virtual Box) and how to use it?

See the All About VDIs sticky in this very forum. Basically, a VDI (Virtual Disk Image) is a file on your host which represents a fixed disk drive in your guest. "File|Virtual Media Manager" can be used to create additional disk drives (VDIs), VM settings can be used to associate these with VMs. The new disk drive will start off uninitialized. You need to use Windows Disk Manager inside the guest to initialize the drive and format it with a filesystem such as NTFS.

allanc wrote:What I am trying to do is boot off the UBCD and access the XP PRO sp3 Virtual Box client which resides on that USB drive.

I'm afraid that doesn't make much sense. If you can "successfully boot off that XP client" then you are already accessing it, there is nothing else you need to do. If you have booted up from a CD mounted in the same VM to which the XP image is mounted then the XP image will be visible as a fixed disk drive C.

mpack wrote:

allanc wrote:What I am trying to do is boot off the UBCD and access the XP PRO sp3 Virtual Box client which resides on that USB drive.

I'm afraid that doesn't make much sense. If you can "successfully boot off that XP client" then you are already accessing it, there is nothing else you need to do. If you have booted up from a CD mounted in the same VM to which the XP image is mounted then the XP image will be visible as a fixed disk drive C.

I apologize and stand (or sit) corrected.
The 'C:' drive the UBCD sees is indeed the XP PRO sp3 Virtual Box client.