I generally do all of my web browsing in a VM. I have one "safe" VM running Ubuntu that has guest services installed. I generally only go to sites I deem are trustworthy here.
I also have an "unsafe" VM with Ubuntu that does not have the guest services installed.
Tonight I was using the unsafe VM to browse some less than savory areas of the internet when one of the annoying FBI popups occured. No big deal...and then I see Norton from my host machine pop up with a blocked action on C:\Windows\SysWOW64\vmnat.exe. The alert name was "Web Attack: Ransomlock Website 7" and it came from the fake fbi website in the popup. This may not be important...but as an FYI I was using Chrome to surf.
I don't fully understand the VMware NAT system, but does this sound like malware could have leaked from the VM onto my host, or does Norton have insight into what vmnat.exe may have been calling and sending back to the VM.
I mainly just want to make sure my host is "safe", but I am also curious as to how this works.