2

I have Windows XP running in a VM as a screenshot factory for browsershots. Since that involves the machine opening browsers with websites not under my control regularly I recently had it compromised. Not a big deal as I had a clean snapshot, but I installed Avira AntiVir after that. Works fine so far (as fine as AV software can work) but before the program pesters me I thought I'd run a full system scan for good measure.

Performance dropped deep into a bottomless pit, somehow. The system in the VM wouldn't react for a long time and finally (I decided to give it a try and run it overnight) stop doing anyting entirely, the VM display also messes up very funnily. The host system was fine, CPU utilization was also not over the top (apart from the occasional 100% spike VBox seems to have sometimes).

This happens reproducably every time I attempt a full system scan and I've given up by now.

Any idea what could cause this? Are there any better free AV solutions that work well in VMs? I'm a long-time non-user of such software and thus don't have any idea what currently can be recommended and what not.

4 Answers 4

0

Did you allocate enough ram for your VM? Are there enough ram in your VM host? Hardware resource is a main source of problem since scanning for virus is a disk+ram+cpu intensive task. Also give AVG a try, it works fine for me in my windows xp VM.

You can also try to avoid using anti-virus in VM (by snapshots and don't use unknown USB drive).

I usually create a "Golden" VM snapshot, then I'll continue using it until I realize I either 1) corrupted the VM windows 2)virus infected. When it happens, I'll restore to the golden snapshot, or the "last known good" snapshots I created along the way.

2
  • Memory could have been a problem, I think it was 192 MiB or something. Since I reinstalled my host system a few days ago the VM is gone, so the question is moot by now. I also had a "golden" snapshot, but the problem is that the VM runs unattended most of the time and the datacenter at the Uni is very quick with locking my account once I got somethnig that distributes spam on that VM, so I'd rather not fix the problem afterwards but also minimize the chances of actually getting somethnig weird on it in the first place.
    – Joey
    Aug 20, 2009 at 13:05
  • Accepting this answer, even though I can't reproduce now, but the memory thing seems most likely to me, given what I observed.
    – Joey
    Aug 20, 2009 at 13:06
0

Could be your snapshot didn't restore properly. What happens if you remove Antivir?

1
  • As the snapshot is simply a copy of the hard drive I doubt that anything can go wrong there and the system runs fine otherwise with our without AntiVir. It's just when I start a full-system scan that the system gets more and more unresponsive until at some point it doesn't seem to wake up again at all.
    – Joey
    Aug 8, 2009 at 13:19
0

Then I'd suggest removing Avira and trying another (free) AV like Avast; if the problem continues, there may still be a lingering bit of malware, which can interfere with AV programs' proper functioning.

Also, does the machine slow down so greatly during "fast scan"?

0

As an anti virus scan is a disk and cpu intensive operation does your computer have virtualization support in the hardware? It's VT-x for Intel and AMD-V for AMD processors.

If you do then it may not be enabled I have to do this in my bios. Once this feature is enabled in the computer and the virtualization program you will get near native performance on the cpu and disk.

1
  • Most VMs, including VirtualBox, are faster without HW virtualization since they were heavily optimized in the times before HW virtualization became prevalent. Also, I'd expect the scan to just take longer, not the guest OS to become unresponsive.
    – Joey
    Aug 20, 2009 at 12:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .