0

I'm analyzing some malicious files on a VM and I'm noticing that every time I open a file, the host's antivirus detects it.

Why does this happen? Is the malicious content escaping to the host?

Improve this question
2
  • out of curiosity, what VM technology are you using?
    – CtrlDot
    Commented Feb 26, 2014 at 15:41
  • I'm using VirtualBox
    – user15194
    Commented Feb 26, 2014 at 22:14

2 Answers 2

Reset to default
3

What I'd guess is happening is: When the guest OS reads an infected file, the hypervisor reads part for of the virtual disk file, the host anti-virus intercepts this read, scans it for viruses, and detects the virus in the guest.

As a workaround I would configure your host AV to ignore the virtual disk files.

Improve this answer
0

It seems like the host and the VM are not isolated.

Maybe, there is a network connection whenever you open this file. Moreover, the antivirus may have detected a threat if there are shared folders between the VM and the host.

I would check the network configuration and the shared files.

Improve this answer
2
  • No shared files, guest's network adapter is configured as NAT.
    – user15194
    Commented Feb 26, 2014 at 13:00
  • Ok, what software do you use for virtualization?
    – crato
    Commented Feb 26, 2014 at 13:23

You must log in to answer this question.