1. If you don't have a seprate machine use vmware ( i am amazed how it was missed out).
I am not...................it is no "silver bullet"..............fine for testing different systems, interfaces etc. but it should not be regarded as a security solution

If you want to analyse malware seriously you should do it on a separate machine/network NOT in your production environment.

To even begin to learn practically, you need the right tools; both software and hardware.