1

I have a host Win 7 system, with a virtual machine running Win XP installed on the host. I have an antivirus installed on the host and also on the virtual machine. Now, my host machine has to deal with using USB drives from a lot of other sources which tend to be infected. My host AV tends to catch those, but since no AV is perfect, I am a little worried.

I figured that two different AVs (one on the host and the other on the VM) have a better chance to detect malware than just one. Hence my questions:

  • Is it a good idea to mount my host machine drives on the virtual machine, and to use the AV on the virtual machine to scan my host (host and VM antivirus are different, and the host AV already scans the drives)?
  • What are the advantages/drawbacks and potential pitfalls in this setup?
  • Can I use the same setup (one AV in VM and one in host) for scanning USB drives - scan with host AV, then scan with VM AV?

If it matters, my host is more important the VM. If something goes wrong in the VM, I can simply remove and recreate a fresh one. Also, I am aware that it is possible to use bootable AV disks, but since I already have this setup, I was hoping to do this. Finally, if the VM matters, I have Microsoft Virtual PC at the moment, but don't mind using VirtualBox too - any pros/cons of the two with respect to this question would be appreciated if there are any.

5
  • Using two anti-virus will likely cause your system to be unbootable. Why are you plugging in devices you know likely will be infected. Furthermore even if your system remains bootable it wouldn't increase the chances of detection.
    – Ramhound
    Feb 22, 2013 at 14:26
  • 1
    @Ramhound Please note that one AV would be in the host, and the other would be in the guest VM. This is always a recommend practice - to install a AV in the virtual machine too. As for plugging in infected devices, sometimes it is necessary, and sometimes not in my control.
    – mayank
    Feb 22, 2013 at 14:49
  • Clarify your question. I still maintain this won't increase your chances of detection only your rate of infection on the host computer. You should be using a seconardy physical computer which is only used to scan USB drives and when reboot goes back to a default configuration.
    – Ramhound
    Feb 22, 2013 at 15:00
  • 1
    @Ramhound Maybe because I am aware of my situation, I can't quite find where the source of confusion could be for someone reading the question. "Is it a good idea to mount my host machine drives on the virtual machine, and also use the AV on the virtual machine to scan my host (host and VM antivirus are different)?" looks clear to me in saying that the other AV would be in the guest VM. I'll try to make it clearer, but if you still find it ambiguous, please feel free to point out the ambiguity or to edit it yourself.
    – mayank
    Feb 22, 2013 at 15:13
  • @Ramhound And a separate physical machine would indeed be ideal, but expensive too. Thanks!
    – mayank
    Feb 22, 2013 at 15:15

1 Answer 1

1

Using two antivirus programs at the same time is not considered a good practice, both for performance reasons and, especially, for compatibility reasons (different AV programs sometimes see each other as unsafe software).

If you really want to be sure that the AV on your host machine works, I suggest to scan your system in safe mode or using a live AV, like Avira AntiVir Rescue System.

Edit Another option, since you say that your host machine is more important than the guest OS, would be to automatically mount your USB drives inside the VM and scan them from there.

6
  • A VM is not guaranteed to keep a virus within the VM operating system.
    – Ramhound
    Feb 22, 2013 at 14:40
  • MS VirtualPC auto-mounts my host drives in the VM. And it is always recommended that the guest VM should also have an antivirus. Will simply initiating a scan by the AV in the guest OS on the mounted host drives cause conflicts with the host AV?
    – mayank
    Feb 22, 2013 at 14:47
  • @Ramhound it is always better than mounting it directly inside the host OS though Feb 22, 2013 at 14:48
  • @mayank it shouldn't, because the AVs are technically on two different machines Feb 22, 2013 at 14:49
  • @user1301428 Thanks! In that case, if I use the guest AV to manually scan the host occasionally, it shouldn't be a problem in compatibility right? And thanks for the link to the rescue system, and the idea of directly mounting USB drives to VM.
    – mayank
    Feb 22, 2013 at 14:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .