Norman Sandbox reuses modules from the scanner engine, the emulator and the virtual memory manager.

The software components of Norman Sandbox are located in one of the virus definition files (NVCBIN.DEF). The sandbox modules are less than 160KB compressed. The memory requirement is about 4MB pr. scanning thread. Since we're running it through emulation, speed is of great importance. On a 700MhZ PIII it emulates over one million instructions per second. On a P4 2GhZ it emulates over 3 million instructions per second. We have designed Norman Sandbox to reduce the number of emulation cycles, especially on clean files and this will be an ongoing effort.

Tests done early in the development phase showed that using Norman Sandbox on all executable files on a regular hard-drive increased the scanning time with about 40%. Compared to the amount of work being done using Norman Sandbox and the benefits of detecting unknown advanced worms and viruses, we do not consider speed a problem.