up vote 1 down vote favorite
share [g+] share [fb]

I have installed Windows Server R2 as a guest in VMware Player in Windows 7. The host OS has Microsoft Security essentials. Since everything that comes to the guest has to come through the host, is it reasonable to assume that the MSE also protects the guest (at least to the extent that MSE does stop malware)?

link|improve this question
1  
The virtual hard disk file is far too large to be scanned without causing major problems, I would expect not just MSE but all AV software to automatically ignore files above a given size. – Harry Johnston Jan 31 at 3:54
@Harry Johnson, thanks a lot. I didn't know that AV software had limitations in terms of file size. – Shredderroy Jan 31 at 5:55
feedback

1 Answer

up vote 6 down vote accepted

No, it isn't. You should treat the guest OS as completely separate.

link|improve this answer
Okay, thanks for that. – Shredderroy Jan 30 at 17:08
Would real time virus scanners not work on an incoming connection to a VM? – Simon Sheehan Jan 30 at 19:12
@Simon Sheehan, that is kind of what I was wondering. I don't know why my question got down-voted. I figured that since even the filesystem of a virtual machine resides in a user's home directory, and is basically "just another file" from the point of view of the host OS, any virus attempting to enter that virtual filesystem would have to first conquer the defences of the host antivirus system. Since the packets coming to the guest must all come to the host connection, it seems reasonable to asuume that the real-time scanning of the host antivirus would stop malware from reaching the host. – Shredderroy Jan 30 at 21:03
@Simon: depending on how a network filter is implemented in a given security product, it might or might not be able to filter network connections to the VM. But network filtering by itself isn't likely to be adequate protection, you should have file scanning as well, and file scanning in the host certainly won't protect the guest's file system. – Harry Johnston Jan 31 at 3:53
These comments are all fine and good. But the answer to the question remains that the guest OS should be treated separately. Your host OS AV might catch incoming guest infections in some cases, but it's unlikely. – Jason Huebel Jan 31 at 16:38
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.