How about updates?

1.
Returnil update.
Should it be updated with system safe on or off?

2.
Other updates.
Should they be updated with system safe on or off?

3.
How can the system be safe at the time of updating
if all updates must be dome with system safe off?

4.
What does Returnil do when its system safe is turned on
if a worm and/or trojan has already been in the system?

Thank you very much!

 

Hi fuquen,

1. Doesn't matter
2. Same as #1 as long as the update doesn't require a restart. If you want the update to be "permanent", you will need to turn the virtualization off
3. See above
4. If the malware is already present on the System and you get an alert from the VG, you can quarantine it from the virtual system and be protected. To remove it from the real system, you should turn the virtualization off and then scan/clean before you turn the virtualization back on - otherwise you would have a bouncing ball scenario where the malware is removed from the virtual system, but returns following a restart because the changes were dropped.

Mike