Virtual Machines and anti-malware

kelper · May 19, 2026

If I run Oracle VirtualBox VMs, are they protected by the host's anti-malware - Webroot in my case. I reckon that a native boot Windows VHD would not be protected; am I right?

I disable MS Security on my host but let it run in my VMs.

Sir_George · May 19, 2026

kelper said:
If I run Oracle VirtualBox VMs, are they protected by the host's anti-malware - Webroot in my case. I reckon that a native boot Windows VHD would not be protected; am I right?

I disable MS Security on my host but let it run in my VMs.

VirtualBox VMs are only partially protected by the host anti-malware.
A native-boot Windows VHD is essentially not protected by the host’s AV while booted into it.
Your setup (host Webroot + Defender disabled; Defender enabled inside VMs) is generally the correct way to think about isolation.

kelper · May 19, 2026

Sir_George said:
VirtualBox VMs are only partially protected by the host anti-malware.
A native-boot Windows VHD is essentially not protected by the host’s AV while booted into it.
Your setup (host Webroot + Defender disabled; Defender enabled inside VMs) is generally the correct way to think about isolation.

Please explain the part I put in bold.

Sir_George · May 19, 2026

kelper said:
Please explain the part I put in bold.

The host anti-malware protects:
The VirtualBox application itself,
VM files stored on disk (.vdi, .vbox, snapshots, etc.),
network traffic it can observe, and some interactions between host and guest.
But it may not fully inspect:
malware executing inside the guest OS,
memory activity inside the VM,
encrypted files or processes within the guest,
or attacks confined entirely to the virtualized environment.

So "partially protected” means"
Your host antivirus can help reduce risk, but it does not replace installing security software inside the VM itself.

garlin · May 19, 2026

The reason a host-based security product can't scan files inside your VM is because of exclusive file access to the virtual disk.

When not in use, a VM's virtual disk could (in theory) be mounted as a host disk volume. A security product could then scan the volume's files. But while the volume is mounted this way, your VM can't be running. Likewise when your VM is running, the virtual disk can't mounted by Windows.

kelper · May 19, 2026

But can Webroot not see internet traffic?

garlin · May 19, 2026

kelper said:
But can Webroot not see internet traffic?

A VM's network traffic is relayed through the host (using a virtual driver). But your AV product can't see this traffic from where it sits.

It's not like an external observer can see VirtualBox (as a Windows process) sending web requests. VM's network packets are dumped out to the host's network stack. I don't know if Webroot inspects at this level. There are more advanced network security products that can filter at this level, but they're highly specialized and expensive.

You could set up something inside the VM, which relays all network requests to an external web proxy (which points to a web proxy you've installed on the host). But now, it's becoming a very messy setup to manage. And probably bad for performance.

kelper · May 19, 2026

Can an infected VM infect its host? My VMs all run MS Security, so I feel fairly safe.

neemobeer · May 19, 2026

Webroot can see the destination IP address and not much else. DNS client cache and resolution only happens in the VM. Webroot doesn't do deep packet inspection as it lacks a SSL decryption feature. Hypervisors (virtual box being a type 2 hypervisor) can be susceptible to hyper visor escape class of vulnerabilities wherein malware executing within a VM can escape and gain context in the host system. If this were achieved and malware dropped on your host system that is where Webroot will take action, however it would be blind if the malware simply existed in the guest.

kelper · May 19, 2026

If malware only exists in the guest, why would I care? I only run VMs to teach myself and they are not used for any serious work.

neemobeer · May 19, 2026

If it can escape it could potentially steal data, credentials or anything else from the host since a VM escape can often interact with the host system with the highest privileges (SYSTEM)

kelper · May 19, 2026

neemobeer said:
If it can escape it could potentially steal data, credentials or anything else from the host since a VM escape can often interact with the host system with the highest privileges (SYSTEM)Seems very unlikely to me.

"it could potentially" is a bit tautological, isn't it?

neemobeer · May 19, 2026

It possiblity might be maybe true yeah sure

Virtual Machines and anti-malware

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computers

Well-known member

My Computer

Similar threads