Battle VMware or Virtualbox?

[ZeroDay]

Which one would you use and why? I'll be using it for testing AV's and other software. I like Virtualbox, which do you prefer?

 

[WinAndLinuxTutorials]

Maybe the answer is here : http://malwaretips.com/Thread-Malware-Testing-VMware-workstation-or-Oracle-VirtualBox

I think either of them is fine for me if the issues of VirtualBox mentioned in the thread in the link above got fixed. That thread is old, so maybe the information there is outdated.

 

[ZeroDay]

Thanks for the link WinAndLinuxTutorials.

 

[Malware1]

VirtualBox because some malware don't work in VMware. These are detecting VMware processes and won't run. Of course there are also malware not working on VirtualBox, but I saw that more aren't working in VMware.

 

[ZeroDay]

Thanks MalwareCentre. I'm leaning towards virtualbox myself, mainly because it's the one I've used most.

 

[ZeroDay]

I've gone with VMware. Thanks for the votes.

 

[WinAndLinuxTutorials]

VirtualBox because some malware don't work in VMware. These are detecting VMware processes and won't run. Of course there are also malware not working on VirtualBox, but I saw that more aren't working in VMware.

Never thought about that. Do you advise us to avoid installing VMware tools/VirtualBox Additions on a VM with malware testing?

 

[McLovin]

I personally have always used VMware and always will.

 

[Littlebits]

It depend on which Windows you are going to use.

VirtualBox works excellent with Windows XP and Linux, however I have ran into a lot of problems trying to get Windows 8 to run in it correctly. I have ran into other issues with Windows Vista and 7. But VirtualBox is free and most users who test malware still use Windows XP.

VMware doesn't seem to give me many issues running any OS but it costs $249.00 unless you just run the 30 Days trial version until it expires.

If you shop around, you could probably buy a cheap computer for the same price.

Now if you want to test malware correctly don't use a virtual system.

Get yourself a cheap real system dedicated to testing only.

Some products and malware don't function properly in virtual systems, so your results will not be accurate.

Thanks.

 

[ZeroDay]

Thanks Littlebits. My original plan was to buy a dedicated PC and I think I'm going to follow through on that. A friend of mine is selling his old PC in a couple of weeks so I'm going to buy that I think. Thanks again.

 

[WinAndLinuxTutorials]

@Littlebits: What about Toolwiz Timefreeze , Shadow defender,etc?

 

[ZeroDay]

I wouldn't use toolwiz timefreeze for testing malware, it doesn't protect the mbr correctly.

 

[Littlebits]

@Littlebits: What about Toolwiz Timefreeze , Shadow defender,etc?

They are only good to test products or malware that doesn't require you to reboot your system. Most security products require system reboots to start their services. If you want to test how malware effects the system in detail, they are not a good option. Also applies to DeepFreeze and Returnil. Some products that don't require system reboots and some malware may not function properly in them either. I'm not completely convinced that your real system could be protected from advanced malware.

Thanks.

 

[Malware1]

VirtualBox because some malware don't work in VMware. These are detecting VMware processes and won't run. Of course there are also malware not working on VirtualBox, but I saw that more aren't working in VMware.

Never thought about that. Do you advise us to avoid installing VMware tools/VirtualBox Additions on a VM with malware testing?

Yes. Also don't run Camtasia in the virtual machine, run it in the real system. It's also sometimes detected by malware.

For example, Win32/Simda is:

Checking list of running processes, registry keys, etc.

HKEY_CURRENT_USER\SOFTWARE\ZxSniffer
Explorer\MenuOrder\Start Menu2\Programs\Debugging Tools for Windows (x86)
HKEY_CURRENT_USER\Software\Win Sniffer
Uninstall\ERUNT_is1
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\
HKEY_CURRENT_USER\SYSTEM\CurrentControlSet\Services\VBoxGuest
HKEY_CURRENT_USER\Software\B Labs\Bopup Observer
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\
Uninstall\Wireshark
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\
Uninstall\Win Sniffer_is1
HKEY_CURRENT_USER\SOFTWARE\B Labs\Bopup Observer
HKEY_CURRENT_USER\SYSTEM\CurrentControlSet\Services\SbieDrv
HKEY_CURRENT_USER\SOFTWARE\Classes\SUPERAntiSpywareContextMenuExt.SASCon.1
HKEY_CURRENT_USER\SOFTWARE\Cygwin
HKEY_CURRENT_USER\SYSTEM\CurrentControlSet\Services\SDbgMsg
HKEY_CURRENT_USER\SOFTWARE\SUPERAntiSpyware.com
HKEY_CURRENT_USER\SYSTEM\CurrentControlSet\Services\IRIS5
HKEY_CURRENT_USER\Software\Classes\*\shell\sandbox
Uninstall\Oracle VM VirtualBox Guest Additions
Uninstall\Sandboxie
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\
HKEY_CURRENT_USER\AppEvents\Schemes\Apps\Bopup Observer
HKEY_CURRENT_USER\Software\Classes\Folder\shell\sandbox
Uninstall\APIS32
PEBrowseDotNETProfiler.DotNETProfiler
HKEY_CURRENT_USER\Software\CommView
HKEY_CURRENT_USER\Software\Syser Soft
HKEY_CURRENT_USER\Software\eEye Digital Security
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\
Explorer\MenuOrder\Start Menu2\Programs\APIS32
HKEY_CURRENT_USER\SOFTWARE\Cygwin
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\
App Paths\wireshark.exe
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\
HKEY_CURRENT_USER\SOFTWARE\SUPERAntiSpyware.com
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\
HKEY_CURRENT_USER\SOFTWARE\Classes\
HKEY_CURRENT_USER\SOFTWARE\APIS32
VBoxTray.exe
CamRecorder.exe
observer.exe
IrisSvc.exe
ERDNT.exe
Regshot.exe
windbg.exe
SBIEDLLX.DLL
ERUNT.exe
WinDump.exe
irise.exe
EtherD.exe
OLLYDBG
SandboxieRpcSs.exe
SandboxieDcomLaunch.exe
dumpcap.exe
Sniffer.exe
wireshark.exe
PEBrowseDbg.exe
SUPERAntiSpyware.exe
DBGHELP.DLL
apis32.exe
SbieSvc.exe
SbieCtrl.exe
CamtasiaStudio.exe
Aircrack-ng Gui.exe
tcpdump.exe
Syser.exe
wspass.exe
VBoxService.exe
SBIEDLL.DLL
ZxSniffer.exe
ollydbg.exe
DrvLoader.exe
cv.exe
SymRecv.exe

It's also checking Windows ID. If it's blacklisted (belongs to Anubis and etc.), then Simda won't run.

 

[xpressive]

Oracle VM Virtualbox ! Because it's free and open-source

 

[King Alpha]

VirtualBox of course.

 

[ZeroDay]

I've decided to go with Littlebits idea and get a dedicated machine for testing malware.

 

[Exterminator]

Virtual box and it's ease of changing the MAC Address

It's free and have never had a problem running it on XP or Windows 7.Have not tried it on Windows 8 because I don't use Win 8 that often.

 

[ZeroDay]

Thanks to everyone for all your suggestions.

 

[landerio]

I never used Virtualbox, so I voted for VMware, actually it's my first and only virtual machine.