If one PC is connected to the internet in the LAN look at the Internet Sharing function of Windows. Works pretty seemless on WinXP. In that case all the sneakernetting would not be needed.

About one seeing the other and the other seeing this one, i've had a long struggle which is firewall related where i cant get BOINCview (3rd party add-on) to see one particular client, which in turns sees all in the network. It's something with 2 software firewalls fighting each other over the specific 31416 port used by BOINC. If either of the 2 is off, it works fine.

The internet machine has one shared folder.
The second machine has no sharing set.
I use the KVM switch to access the second machine and then use that single folder as a port for dragging and dropping.
Even if malware could see the shared folder on the internet machine it still could not access the second machine (i hope) because there is no sharing allowed.
So if i keep the internet machine clear of malware the sensitive information on the second machine should be safe.
I've just gone dual-core on the internet machine and i can now run all the security software while listening to the radio or even watching tv :-).

Are you saying that although the second machine has no internet connection and is not visible over the LAN malware could still gain access to it? How is this possible?

I don't understand proxies so i wont be using that.

Thank you, i'm going to have to rethink this.

I think the most important things you can do are:

a) Don't download rubbish. I dare say most malware gets onto people's machines by them downloading something from an untrustworthy site or from a "friend" whose machine is infected, etc. I always download software from a trusted source (preferably the company which produces it or sourceforge or cnet, etc).

b) Be unseen. Most direct attackers on the net are scanning thousands/millions of IP addresses. If they scan your IP address and get no response, they will assume there is nothing there and go on their way. Many broadband modems will reply to packets from the outside world even if they have a firewall function enabled. (... stupid of them, but it's the way it is. The reply is a rejection, but it still tells the attacker that there's something there.) If you forward all incoming traffic to a firewall and then silently drop all incoming packets that aren't in response to something you sent out, you're invisible. Shields Up on GRC's web site is an easy way to test how visible your system is to outside attackers. (I do have a few ports open for IMs to use, but they are way above the usual services range, so an attacker would have to probe thousands of ports to hit one and then there would need to be a vulnerability in Miranda for it to be useful to them.)

fwiw, I've been online for 18 years and never had a virus or an anti-virus program on any of my home machines.