[Bob434]

[[My personal option is to use only Linux or MacOS for internet stuff,]]

That’s what i do- i dual boot- and only use windows offline only, for windows only programs and windows gaming- *(which i do at night after all my INTERNET stuff is done on linux for the day- i end the day playing dues ex or f E A R or something lol- helps me wind down- but i also need windows to run photoshop- I have 2 hard drives and just move all the finished work to my secondary drive and boot to linux again and upload to net-)

[[Once the updates stop, why connect to the internet with it if there are other safer options?]]

Exactly- although i don’t even connect my windows boot to net at all (except to update virus protection or windows updates or game update- so although hte risk is low- it’s still a little bit of risk- I imagine htough after windows 7 updates cease- it will still be ok to go to known good sites only briefly?)

[[If you only have the one hardware machine, and it’s got Win7 installed “on the metal”, you might want to consider getting some virtualization software (VMware, VirtualBox, etc.) for Win7, create a (free) Linux VM, and use only the Linux VM for accessing the internet.]]

If you do this with windows as the host- aren’t you still somehow vulnerable on your windows os? I’m not sure how htis works- I nkow that if the host and VM share folders, it can make both vulnerable- but not sure if there is no sharing- does that make the host invulnerable to viruses when VM connects? I thought the VM connects through host Internet connection, no?

[dayglored]

[[If you only have the one hardware machine, and it’s got Win7 installed “on the metal”, you might want to consider getting some virtualization software (VMware, VirtualBox, etc.) for Win7, create a (free) Linux VM, and use only the Linux VM for accessing the internet.]] > If you do this with windows as the host- aren’t you still somehow vulnerable on your windows os? I’m not sure how htis works- I nkow that if the host and VM share folders, it can make both vulnerable- but not sure if there is no sharing- does that make the host invulnerable to viruses when VM connects? I thought the VM connects through host Internet connection, no?

To prevent malware from coming over the network connection into a guest VM and affecting the VM host, there are a few potential vectors that should be controlled for:

• As you mentioned, shared folders between host and client should be disabled

• The guest VM should not know the VM host's name or IP (via DNS or /etc/hosts)

• If possible the guest VM should be networked as "bridged" so it has an independent IP address from the VM host, and it should be in a separate subnet to minimize chances of malware attempting network traversal. For example (assuming the VM host is behind a local 192.168 NAT):
  • VM host IP = 192.168.1.xxx
  • VM host netmask = 255.255.255.0
  • guest VM IP = 192.168.2.xxx
  • guest VM netmask = 255.255.255.0

• There are probably additional precautions one can take, but the above are quick and easy and provide decent security.