Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have Windows XP running in a VM as a screenshot factory for browsershots. Since that involves the machine opening browsers with websites not under my control regularly I recently had it compromised. Not a big deal as I had a clean snapshot, but I installed Avira AntiVir after that. Works fine so far (as fine as AV software can work) but before the program pesters me I thought I'd run a full system scan for good measure.

Performance dropped deep into a bottomless pit, somehow. The system in the VM wouldn't react for a long time and finally (I decided to give it a try and run it overnight) stop doing anyting entirely, the VM display also messes up very funnily. The host system was fine, CPU utilization was also not over the top (apart from the occasional 100% spike VBox seems to have sometimes).

This happens reproducably every time I attempt a full system scan and I've given up by now.

Any idea what could cause this? Are there any better free AV solutions that work well in VMs? I'm a long-time non-user of such software and thus don't have any idea what currently can be recommended and what not.

share|improve this question
up vote 0 down vote accepted

Did you allocate enough ram for your VM? Are there enough ram in your VM host? Hardware resource is a main source of problem since scanning for virus is a disk+ram+cpu intensive task. Also give AVG a try, it works fine for me in my windows xp VM.

You can also try to avoid using anti-virus in VM (by snapshots and don't use unknown USB drive).

I usually create a "Golden" VM snapshot, then I'll continue using it until I realize I either 1) corrupted the VM windows 2)virus infected. When it happens, I'll restore to the golden snapshot, or the "last known good" snapshots I created along the way.

share|improve this answer
Memory could have been a problem, I think it was 192 MiB or something. Since I reinstalled my host system a few days ago the VM is gone, so the question is moot by now. I also had a "golden" snapshot, but the problem is that the VM runs unattended most of the time and the datacenter at the Uni is very quick with locking my account once I got somethnig that distributes spam on that VM, so I'd rather not fix the problem afterwards but also minimize the chances of actually getting somethnig weird on it in the first place. – Joey Aug 20 '09 at 13:05
Accepting this answer, even though I can't reproduce now, but the memory thing seems most likely to me, given what I observed. – Joey Aug 20 '09 at 13:06

Could be your snapshot didn't restore properly. What happens if you remove Antivir?

share|improve this answer
As the snapshot is simply a copy of the hard drive I doubt that anything can go wrong there and the system runs fine otherwise with our without AntiVir. It's just when I start a full-system scan that the system gets more and more unresponsive until at some point it doesn't seem to wake up again at all. – Joey Aug 8 '09 at 13:19
This is really a comment, not an answer to the question. Please use "add comment" to leave feedback for the author. – Renan Aug 9 '12 at 21:36

Then I'd suggest removing Avira and trying another (free) AV like Avast; if the problem continues, there may still be a lingering bit of malware, which can interfere with AV programs' proper functioning.

Also, does the machine slow down so greatly during "fast scan"?

share|improve this answer

As an anti virus scan is a disk and cpu intensive operation does your computer have virtualization support in the hardware? It's VT-x for Intel and AMD-V for AMD processors.

If you do then it may not be enabled I have to do this in my bios. Once this feature is enabled in the computer and the virtualization program you will get near native performance on the cpu and disk.

share|improve this answer
Most VMs, including VirtualBox, are faster without HW virtualization since they were heavily optimized in the times before HW virtualization became prevalent. Also, I'd expect the scan to just take longer, not the guest OS to become unresponsive. – Joey Aug 20 '09 at 12:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .