Luketan/virtualization

VirtualBox is a open source virtual machine competitor to the well known vmware. It was recently acquired by Sun. This 1.6 is the first version released since then.

Interesting introduction of new class of "virtualization" software

From the page: "on is ON, your Windows system is running on a virtual partition meaning that every single change in the system partition actually takes place in memory. Therefore, all data and modifications will be lost after your system reboots. By restarting you PC, Returnil will discard all attempted changes made to your System Partition while Protection is ON.When the Returnil Protection is OFF, you can install or remove any programs"

Very interesting, these shadow type software seem to be falling out of the sky for free these days.

Like PowerShadow, Shadow Surfer, Windows Steady State , this virtualizes your system partition ,so that on reset all changes are gone.



I was somewhat confused at first between the options "Sesson Lock" and "System Protection". but essentially, when you turn on System Protection (see screenshot below), it will force a reboot, and from then on (until you turn it off), it will always start in virtual/shadow mode.



On the other hand, if this feature is off, you will start windows in normal mode as usual, but by selecting "session lock" you go into virtual/shadow mode immediately without the need to reboot.

The main drawback of this type of software is that *every* change you make is gone. This isn't a problem if you can save changes in a seperate disk partition or on a USB drive, but a lot of people only have one partition.

Returnil solves this little problem, by offering to mount a virtual Z drive, where you can store files that will not be removed. See screenshot



Returnmil claims to be safer than its rivals because all temporary changes are kept in memory as opposed to being written on the hard-disk as well as helping to extend the life of the hard-disk. I'm not qualified to address these claims, but I can report that performance wise, if anything Returnnil is actually better than Windows SteadyState! Even on a Virtual machine that is allocated only 256 Mb of Ram (system requirements states 128MB for XP), there is no appreciable load at all!

Currently it is my favourite

From the page: "Returnil Virtual System Business Edition â€" Using powerful virtualization technology that clones your System Partition in RAM, Returnil offers your users the ability to recover from harmful or unwanted changes with a simple reboot of the computer; All this without sacrificing computer performance or usability while helping to reduce technical support intervention and the need for routine maintenance.

Returnil Virtual System Personal Edition â€" Minus add-on utilities and with limited technical support, the Personal edition includes the same functionality as our business edition for Home users."

Yet another free virtualization option for personal users.

From the page: "Joebox is an simple sandbox application with a unique special concept. It is designed for automatic behaviour analysis of malware on Windows based operating systems. "


Interesting site comparing various tools used for sandboxing and malware analysis. You can also submit binaries for testing via submit@joebox.org

From the page: "Windows SteadyState
Brief Description
Whether you manage computers in a school computer lab or an Internet cafe, a library, or even in your home, Windows SteadyState helps make it easy for you to keep your computers running the way you want them to, no matter who uses them."

Much improved from the old Microsoft Shared Computer Toolkit, for example you don't need repartitioning for the Windows Disk Protection.

It can be used to restrict user accounts in various ways.
















But the main interest for me is still the Windows Disk protection function that can rollback changes quickly. It takes up half your free disk space (up to 40 GB), but this is adjustable. Usually you can set it up to discard all changes on restart (not log off) which is typically for software of this type (like PowerShadow , or Shadow Surfer ). But what is nice is that you can keep these changes for longer periods of time before discarding. This is useful if you want to test software that require reboots to work (those that require drivers).

The first time you set up the cache file takes some time (about 30 minutes). I find on my system it slows startup time by about 30 seconds, and shutdown time by about half that (probably depends on size of cache file, amount of changes etc). But there is no appreciable slow down on a 512 Mb, 3.06 GHZ machine running one antivirus and firewall once it is past the startup.





You can even set it so it will automatically download Windows Updates correctly. A nice touch.



There is a lot of other tricks and tips in the help file, that I have yet to explore.