VMWare Player vs FDISR

Discussion in 'FirstDefense-ISR Forum' started by WilliamP, Dec 10, 2006.

Thread Status:
Not open for further replies.
  1. Peter2150

    Peter2150 Global Moderator

    Joined:
    Sep 20, 2003
    Posts:
    20,590
    Depends on what you want to do. VMware suggests a minimum of a 256mg machine. Since I wanted to play and have the resources I gave my VM 1024mg of ram, and built a 20g virtual hard drive. Yes if you want to do this and have good response you do need a good computer.
     
  2. Peter2150

    Peter2150 Global Moderator

    Joined:
    Sep 20, 2003
    Posts:
    20,590
    Probably not. The only disk access the machine has is it's own drive. You can even look at the bios and it only sees it's own resources.

    And while First Defense only protects you from trashing the system, in the vm machine you can trash the disk and recover easily. To test I build a 2nd hard drive and imaged the virtual system to it. Then I did a restore, and aborted it which naturally left the disk a mess. It recovered back to a snapshot in a couple of minutes.

    Pete
     
  3. charincol

    charincol Registered Member

    Joined:
    Nov 10, 2005
    Posts:
    113
    For those who are queasy about the cost of VMWare, Microsoft Virtual PC is free now. It is almost as fast as VMWare Workstation. Microsoft OS's actually run a little smoother in it, making up for the performance hit a bit. I have used both and they are both very good.

    Some of the differences are:

    Networking, virtualized hardware, and *nix compatibility is better in VMWare making it preferable for absolute performance.

    I can tell you that frozen snapshots seem to start a little quicker in Virtual PC. Win98 also boots a lot faster in it. XP runs a little better on Virtual PC. An nLite'd version of XP runs very well with only 128MB RAM allocated to it. Virtual PC also has a feature similar to VMWare. It's called undo disks. You select it, boot the virtual machine, the "hard disk" is now read only. All writes, including registry changes, file edits/saves, and any malicious activity is written to a separate file that you can choose to delete or commit when exiting the virtual machine. This makes for an ideal test environment for new or malicious software. If new software requires a reboot, no problem. Just reboot the virtual machine - the undo disk is kept until you EXIT the virtual machine.

    Virtual PC is simpler.

    VMWare's install is 2-3 times bigger, and uses more system ram when running. Not a real big deal.

    Did I say the networking in VMWare is excellent? (Virtual PC has networking capability, it's just not as robust or easy to use.)

    The 2 are the best for virtual machine software. I don't hold either above the other (even though this post may sound like I think Virtual PC is better than VMWare). I just think it's great to see others finding out how cool this type of software is and wanted to let people know about MS Virtual PC (which is free - way cool) and almost as good as VMWare in performance. It also just happens to be one of MS's best software's (a rarity). I have used both for different things.

    P.S. Both totally isolate the guest OS from the host OS. Getting rid of malware is just a matter of deleting the hard disk file. It's a good idea to backup the hard disk to a compressed file. I use 7zip for mine.
     
  4. Meriadoc

    Meriadoc Registered Member

    Joined:
    Mar 28, 2006
    Posts:
    2,642
    Location:
    Cymru
    charincol :
    Between MVPC and VMWare I'd agree on that.
    Okay, but thats not my experience. I've found MVPC slower all round.
    Again not my experience, but nLite'd version is a very good idea, I've done exactly that.
    Okay, but theres nothing hard about any of this, I think anyone could use the free MVPC, VMWare Server or Player with just alittle reading.
    Very good point and suggestion charincol.
     
  5. wilbertnl

    wilbertnl Registered Member

    Joined:
    Dec 29, 2004
    Posts:
    1,850
    Location:
    Tulsa, Oklahoma
    What I hear you say is that Virtual PC is a better deal. ;)
    The demo on this page might give you ideas.
    I'm surprised how well a Virtual Machine runs on my budget PC, for beta testing and evaluation (or AOL radio) it performs well.
     
    Last edited: Dec 19, 2006
  6. cerberus

    cerberus Registered Member

    Joined:
    Nov 15, 2006
    Posts:
    10
    Hi all,

    If you install FDISR and take snapshots, can you successfully install VMWare Player & VMWare Converter into one of these snapshots.

    If so, are there any special steps that are needed ?


    Tks
    Cerberus
     
  7. cerberus

    cerberus Registered Member

    Joined:
    Nov 15, 2006
    Posts:
    10
    Wasn't sure if it matter what order these were installed in.
     
  8. Peter2150

    Peter2150 Global Moderator

    Joined:
    Sep 20, 2003
    Posts:
    20,590
    Couple of thoughts

    Virtual PC vs VMware

    As far as ease of setting up. I both fairly easy until I hit networking. I never got Virtual PC 2007 beta networked which killed a lot of stuff. The VM machine just came up and was on line.

    It was easy to get help for VM on their forum. Uh Microsoft, well thats another story

    Vm has Hardware graphics accelerator support, don't know about VPC

    Since I gave my VM 1024Meg of memory and a 20gig drive clearly resources aren't an issue for me. I have no comparison.

    As far as FDISR, I just installed it in a snapshot like any other program. I set my VM machine on a second drive just to have it out of the way due to size. As to the converter, I didn't try it. I installed Windows in the VM machine from scratch. Using the converter might create activation issues. This way I was able to use a separate XP license.

    Pete
     
  9. wilbertnl

    wilbertnl Registered Member

    Joined:
    Dec 29, 2004
    Posts:
    1,850
    Location:
    Tulsa, Oklahoma
    Peter and charincol,

    I want to thank you for your inspiration, you motivated me to give Virtual PC 2004 a try and I find myself currently continuing the beta-test for imaging/snapshot software in a virtual Windows 2000 system.
    I could never imagine that this works, but it does. It's a pleasure to watch it reboot while I continue working on the test report. :D

    By the way, Peter, VPC 2004 connects to the network right away. :thumb:
    It is able to mount a couple VHDD's, I imagine storing the pagefile.sys and data on a second VHDD.
    Also folders on the host are easily shared.

    Again, thank you for motivating me to consider this. It's fun.
     
  10. Hermescomputers

    Hermescomputers Registered Member

    Joined:
    Jan 9, 2006
    Posts:
    1,069
    Location:
    Toronto, Ontario, Canada, eh?
    It is possible to transfer a virus to the host of a virtual machine by sharing directories on the host with the VM.

    As a side note you could allocate a directory on the "host" Operating system and use it to share data with the virtual machine. This directories content is "open" to virus and spy ware infection like your C: Drive in the VM in the event your VM gets infected by a bug... However nothing would boot from it on the Host and as such the virus would be passive until activated during a session of the host. Say by clicking on an infected executable... (Unless you shared C:\)

    As for the best options you can run "VM Server" free of charge. That however requires Windows 2000 or 2003 Server to run. It beats the hell out of Microsoft on so many points, performance, resource utilization and not to mention networking and the ability to port VM's across a wide spectrum of systems.

    Hope this helps!
     
    Last edited: Dec 19, 2006
  11. wilbertnl

    wilbertnl Registered Member

    Joined:
    Dec 29, 2004
    Posts:
    1,850
    Location:
    Tulsa, Oklahoma
    Last edited: Dec 19, 2006
  12. Peter2150

    Peter2150 Global Moderator

    Joined:
    Sep 20, 2003
    Posts:
    20,590
    Yes it is fun. Really blew my mind to see FDISR running in a VM. It's cool because you can test stuff for interaction with MBR with out damage to your host. I never tried VPC 2004, I fired up the VPC 2007 beta. But my machine has Nvidia network stuff, and I've learned it can be cranky.

    One thing to check on VPC is there recovery back. VM's seems bullet proof. I essentally wiped out my drive, and the recovery was perfect.

    I also have played with imaging. Still blows my mind.

    Hey Wilbert, have you tried Eaz-Fix on the VM?

    Pete
     
  13. wilbertnl

    wilbertnl Registered Member

    Joined:
    Dec 29, 2004
    Posts:
    1,850
    Location:
    Tulsa, Oklahoma
    I know... I imagine mounting a vHDD from another VM and perform some disk management. (imaging, defrag, etc).
    Well, I haven't seen recovery, but I found the differential VM's. :eek:
    VPC has virtual disk writing, you can basically freeze a VM, modifications are discarded when you close a session. And you need to commit modifications if you want to save them.

    Not eazFix, yet. I got a beta release from farstone.com for torture testing. ;) I'ts amazing that the pre-os simply functions. :thumb:
    And the rest functions too.

    Oops, just installed the free VMware Server (does support all Windows releases)...
     
    Last edited: Dec 19, 2006
  14. Peter2150

    Peter2150 Global Moderator

    Joined:
    Sep 20, 2003
    Posts:
    20,590
    What I like in the VM machine that makes it neat is if I trash the disk and make it totally unbootable even with say FDISR, with the machine closed I can go to the snapshot I took and I am back in business. That's seriously cool.
     
  15. wilbertnl

    wilbertnl Registered Member

    Joined:
    Dec 29, 2004
    Posts:
    1,850
    Location:
    Tulsa, Oklahoma
    Are there advantages of the snapshot feature compared to simple-minded copying the folder with *.vmdk files to a backup device?
     
  16. Hermescomputers

    Hermescomputers Registered Member

    Joined:
    Jan 9, 2006
    Posts:
    1,069
    Location:
    Toronto, Ontario, Canada, eh?
    Snapshot allows you to make temporary test modification. Like say you wanted to try getting infected by a virus. You do it in a snapshot. it craps your system and u just "Go back" it is much faster and you can control iterations of the same image more effectively than copying but copying works almost the same...

    I usually create a "Generic Base" VM and then load all kinds of experimental crap into the snapshots. Dont like the results you simply revert and re load a new "custom" set and off you go. You cant do that quickly with a copy. and over time you cant see what you have done either. Snapshots have a neat view mode to allow tracking... You can also start working in the snapshot as it is being "manufactured" without much care about it... very neat technology. Saves me hours.

    I am currently running 6 operating systems 4 of which are versions of Linux.
    Here is a pic of what it looks like just for fun! :-*
     

    Attached Files:

    Last edited: Dec 19, 2006
  17. Peter2150

    Peter2150 Global Moderator

    Joined:
    Sep 20, 2003
    Posts:
    20,590
    Probably the biggest advantage is time. I can go back to a snapshot in a couple of minutes. You know how long it takes to copy a 20gb file.
     
  18. Peter2150

    Peter2150 Global Moderator

    Joined:
    Sep 20, 2003
    Posts:
    20,590
    I just did a test to see how bullet proof the snapshots are. First I created a clone, and then took a snapshot. Then I booted to my bart disk in the vm, and using acronis, I repartitioned and reformated the c drive. Needless to say the VM wouldn't boot. Then selected the recovery point, and in a matter of minutes was back to normal. Adds a dimension to the kind of stuff I'll try.
     
  19. cerberus

    cerberus Registered Member

    Joined:
    Nov 15, 2006
    Posts:
    10
    What is in place to prevent somebody installing the 30day trial vmworkstation into one or more Fsidr snapshots, then simply deleting the snapshot and starting again at the 30 day point. How do programs defend themselves from this ?

    If it can be done repeatedly - is it then possible to use the original XP disc/licence no. to create a virtual machine using Vmworkstation ? This to be used for testing up to the point where the Windows activation becomes due.
     
  20. Hermescomputers

    Hermescomputers Registered Member

    Joined:
    Jan 9, 2006
    Posts:
    1,069
    Location:
    Toronto, Ontario, Canada, eh?
    Have you ever heard of a "Time Server"?

    Here is a nice trick for "El Cheapos" like you! :)
    Install VMware Workstation then create a large stack of Virtual Machines.... then uninstall VMware Workstation and use the "Free" VMware Player to work with all the Virtual Machines you already created....
    It works, its legal and cheap! real cheap! as in Free!

    This way u can get real addicted to Vmware and eventually purchase it... I hope!

    as for the last part of your statement.... Yer pushing it!
     
    Last edited: Dec 20, 2006
  21. wilbertnl

    wilbertnl Registered Member

    Joined:
    Dec 29, 2004
    Posts:
    1,850
    Location:
    Tulsa, Oklahoma
    VPC has the undo option. Boot into a VM, do whatever you please and when you close the session you have a couple options:
    - Make the changes permanent by merging the undo information with the VM.
    - Save the changes in a undo file.
    - Discard the changes.

    Does that sound like software virtualization in a virtual machine?

    VPC uses a dynamic sized disk, which makes the installation of Windows into it slow. I bet there are tweaks that I yet haven't discovered.
    If repartitioning/formatting of a fully installed disk isn't committed permanently, then I think that VPC is offering a fast recovery too.
    I also want to see what a differential VM does, it sounds promising.
     
  22. Peter2150

    Peter2150 Global Moderator

    Joined:
    Sep 20, 2003
    Posts:
    20,590
    Sounds like the same functionality with a slightly different implementation. Still blew my mind to be able to reformat the disk and simply back to what I had. THis offers a different level of testing. I've been playing with the different imaging programs I have, only testing bare metal restores as opposed to just restoring. SOme interesting results.

    Pete
     
  23. Peter2150

    Peter2150 Global Moderator

    Joined:
    Sep 20, 2003
    Posts:
    20,590
    Cerberus

    You probably could do exactly what you are asking about and it work with many programs. Just remember one thing beyond technology. That is in life what goes around generally comes around. You do good, you will get good. You take advantage of people, and you will get taken advantage of. Simple. If you find software of value, then pay for it. You will be the better for it.

    Pete (getting back off soapbox)
     
  24. cerberus

    cerberus Registered Member

    Joined:
    Nov 15, 2006
    Posts:
    10
    Hi all

    Not that I have a deal of faith in the Karma thing Peter, my questions are based on curiosity, not the need to save a few coppers.

    I don't presently have the resources on my test box to make running WMworkstation a viable proposition. Still, as I was looking at the VMworkstation trial page in the same local timeframe as I was re-installing XP and faced with re-activation, the questions arose. More particularly, how do programs defend against abuse by imaging. Do they have to react in the same way as some malware, seeking out program signatures and presenting a targetted response ?

    I am running fdsir and hope to test the VMware Converter within a snapshot, just to see how it plays. VMPlayer installed fine. I tried installing the converter a couple of days ago and failed with a runtime error. Apart from being fully patched and having FF 2.0 installed, there was only fdsir on the box. I tried several variations of snapshots, disabling pre-boot etc but nothing worked.

    I tested the convertor install on another box and it seemed to install properly, so not a corrupt download .

    I'm presently reformatting to try again just to see what happens.

    I want them to function in a snapshot as they won't be staying on the testbox beyond the experiment. The advantage to me of fdisr is that I can have fairly small responsive images. My memory of using Ubuntu in VMPlayer some months ago, was that it was too slow on my box, to be a sustainable experience for me.

    It's all about gaining new experiences & options.:cool:
     
  25. kennyboy

    kennyboy Registered Member

    Joined:
    Oct 4, 2006
    Posts:
    431
    Could anyone compare Parallels Workstation with VM Workstation please.
    I have read that Parallels is easier to use, but does that mean that VMware is that difficult? Would like some advice before committing to either.
    Also, as I dont have a big enough HD to accomodate these, is it possible to allocate space on my External HD for the VM, and how would this work with FDR?

    On second thoughts, maybe it wouldnt work at all as FDR only works on the C drive of course, so it would be impossible to install the VM in a snapshot on C and use the Ext HD as the disk space....wouldnt it??
    Many Thanks for any help.
     
Thread Status:
Not open for further replies.
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.