cockpitvisit

Only keystrokes you make inside the virtual machine. So if you have a virtual machine you only use for online banking, and another virtual machine where you do all other internet surfing (and maybe have spyware installed), the spyware won't be able to get your online banking password.

Technically, they can see it if you have spyware on your PC. In fact I think an employer is much more likely to monitor your Web surfing than your keystrokes, and using yahoo mail could easily raise an alarm. The advantage with yahoo and hotmail is the anonymity, the communication itself is no more secure than through your ISP. But the anonymity goes down the drain if you are doing it from your work PC and your employer is spying on you, because they obviously know who you are.

A spyware can read all files on all disks plugged in. It doesn't matter whether files are used or not (though it is more likely it would want to spy on exactly the files you have opened). There are USB disks with encryption, but they do not protect from spyware. Once you have unlocked your files to use them, the spyware can read them too.

Using plug-in disks is still safer than keeping sensitive files on your PC permanently, simply because it is less likely the spyware would catch the files. It is even better to disconnect the PC from the Internet while a disk with sensitive files is plugged in. This way, the spyware would have to determine which files are of interest for it, copy them to some other location and then upload them later once the Internet connection is restored. This is very unlikely to happen.

So anything you do to make your PC "unusual" from the spyware's point of view is a security improvement.

LAX21

If the VPN connection is done with the Windows built-in VPN Client, then you have the option of de-selecting "use default gateway on remote host" meaning that your internet traffic will not be forwarded thru the VPN (unless it's directed towards that VPN) - as it would normally be if that option is left checked.
I'm sure other VPN clients have similar options but I have not dealt with those that much.

JohnnyP

When I travel, rather than carting my personal PC with me everywhere, I take my work laptop. I'm careful to always log into GMail or Yahoo when the "https" preface. As I understand it, this prevents them from reading the transmissions between the browser and the GMail server. Hopefully, this is true!