1

Let's say I have VirtualBox or Vmware Workstation on a Windows 10 Pro host, hosting Windows or a Linux distribution such as Ubuntu or CentoS). If I have an antivirus or Internet Security software on the Windows host, could it protect Windows or Linux VM's? Can any consumer, SOHO, or small business version of Norton, Avast, BitDefender, Kaspersky, McAfee, or other security software, protect virtual machines while the security software is on the host operating system?

1
  • An AV on the host cannot access the memory or filesystem in a VM
    – schroeder
    Nov 6 '20 at 21:16
-1

The answer is bit of yes and no, but in some cases, it is a definite no. It really depends on what security software you are using, and what type of virtualization software you are using.

A traditional antivirus program that just scans a host computer cannot protect your VM. The reason being as @schroeder said, "An AV on the host cannot access the memory or filesystem in a VM."

If you are using an internet security software that has a HIPS (Host Intrusion Prevention System) feature that acts like a network firewall, the answer is bit of yes and no. The yes part is if the VM program tries to send a request (considering that you are using a browser inside a VM, like VirtualBox), thru the host to access a website. In the scenario that the HIPS detects the destination of the request or source address of the data received listed in a global or local blacklist, the HIPS would drop the data. In that case, the VM would not receive anything. The no part is related to the fact that the security software would not be able to access the memory or the filesystem of the VM to scan for viruses.

3
  • This is a big corner case and not really helpful. Web filtering by destination can also be done on the router or the ISP. At that point, it's not about the host's AV. So, if the host's AV has HIPS, and if that HIPS will read the traffic coming from the VM (which requires the HIPS has access to the networking stack), then maybe traffic might be blocked.
    – schroeder
    Nov 7 '20 at 8:46
  • In my opinion, many modern day AV software comes with HIPS, in fact even consumer versions come with it as well. To name a few, ESET, Norton, McAfee. It even says it on their website under the features. It may not say HIPS clearly, but it would state something along the lines of what an HIPS would do. Under a basic scenario how would a HIPS with a IP bock list work with web browsers if it does not have to the network stack? Nov 8 '20 at 2:48
  • I used the word "HIPS" because you did, but don't lose sight of what you are talking about. You are talking about IP block lists. And that feature would need to be deployed at such a deep level in the stack to be able to inspect traffic coming from the VM. And, don't lose sight of the bigger topic: if it did work, this is hardly worth mentioning when the topic is protecting a VM from viruses and this feature isn't really about AV.
    – schroeder
    Nov 8 '20 at 8:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.