11

VST Plugins are DLL files available to be put into a folder in the Music Tool which then can use this as a plugin.

Does VST have a mechanism not to execute malicious code inside the dll file?

Can I safely install them without anti-virus?

  • You're asking if VST Plugins are malicious? – RoraΖ May 19 '15 at 14:30
  • Not "are", but "could be". – DanFromGermany May 19 '15 at 14:31
  • 1
    Any form of executable code could be malicious. It comes down to if you trust the plugin or not. Extensive analysis of the DLLs is the only way to see if anything nefarious is occuring. – RoraΖ May 19 '15 at 14:33
  • 6
    Why are people flagging this as "Primarily opinion based"? It's a good, objective question, asking whether VSTs are somehow prevented from acting maliciously, and whether there's a risk. Please read things fully and properly before you issue a flag. – Polynomial May 19 '15 at 17:10
  • 1
    @raz - If the plugins were executed within a sandbox that would stop the DLL doing anything nefarious – paj28 May 22 '15 at 16:01
12

A VST is just a DLL which exposes a specific interface. As such, it can contain arbitrary code, and can do anything that an EXE could do. Treat it as such. If you don't trust it, don't run it.

Keep in mind that virus scanning will only protect you against known signatures, so something unknown or custom might still catch you out. Running the plugin through VirusTotal or a similar service may help, but ultimately you can never be sure and there is always a risk.

My advice would be to research the plugin and the person/company who wrote it, and the site you downloaded it from if it's coming from somewhere generic. Verify their trustworthiness by reading reviews, looking at their other work, and seeing which communities they're active in and trusted by.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.