1

I'm testing vulnerability and severity of certain viruses on my Oracle VirtualBox (Windows XP) and virtual machines internet connection is set to NAT.

The issue is that my actual HOST PCs (Win10) antivirus (Bitdefender 2016) immediately acts when I'm trying to visit a certain website on my guest machine to get the virtual machine infected. It blocks access to websites immediately thus deleting files that are infected. I couldn't find any option that would turn off guarding my virtual machine either.

To me it is pretty unusual but at the same time, really impressive! It may prevent potential threats and harms that could break/sneak into my HOST machine and damage the files.

I still want to hear your opinion on this or if there is a way to isolate the virtual machine from the HOST machine so that the antivirus only guards HOST machine and totally ignores what's going on in guest OS.

4
  • Please don't edit the answer into your question. Super User is a question and answer site and answers should be separate from questions. You can answer your own question instead.
    – DavidPostill
    Mar 6, 2016 at 17:09
  • Get rid of the anti-virus software and just think about what you click. Anti-virus won't help against 0day-threads anyways, and those are the most problematic.
    – TJJ
    Mar 6, 2016 at 19:06
  • @TJJ if you claim AV cannot help you're so wrong. Either you are an elitist or you don't want to accept the fact that AVs are actually pretty safe as it has been proven many times. Especially Bitdefender.
    – Wolf G
    Mar 6, 2016 at 19:40
  • Well, for the general user I'd still suggest anti-virus, at least to warn of already recognized files. But you don't seem to be the regular user, doing the testing and virtualbox and what not. So this is a suggestion to YOU only.
    – TJJ
    Mar 6, 2016 at 20:33

2 Answers 2

1

I finally found a solution! Took me some time to ensure that it worked as intended. (Note that your antivirus may still keep records and logs and keep guarding your HOST OS)

  • Disable virtual machines firewall
  • Set VM OS network settings to NAT
  • Download and install TOR browser
  • Do not use internet explorer, chrome or firefox to download viruses or visit websites since they are pretty strong as they don't produce same level of damage. (They will indeed block access to many malicious websites)
  • Now your antivirus (Bitdefender 2016 in my case) will not block any website or participate in anything that virtual machine does. You are now free to infect your guest OS.

(If you don't own an antivirus/good antivirus, then your HOST PC may be in danger and you should probably not commit such action even in a virtual machine.)

2
  • (I'm not using live anti-virus solutions for almost two decades and all my machines have never been infected. I'd call anti-virus snake-oil.)
    – TJJ
    Mar 6, 2016 at 19:05
  • I would say some smart viruses is written in a way so that it can detect if it is infecting a virtual machine. Just because it is a virtual machine does not mean it is safe, you just have to treat it like another physical machine on your network. But yet again, my question wasn't about getting rid of viruses.
    – Wolf G
    Mar 6, 2016 at 19:41
0

Either your anti-virus product is hooked into the physical network adapter and is seeing suspicious traffic coming out of it.. or the malware is being written to the virtual hard-disk (and into a physical file on the host) and the AV is detecting from the real-time scan that bytes matching an infected file have been written into a file.

Does temporarily disabling the real-time scanning in your A/V help and do you know if the alerts specifically mention network activity?

5
  • Thanks Matthew! I just browsed logs and observed that each and every log contains the same message, "The application virtualbox.exe accesses a web resource "link" that has been detected as infected. The web resource has been successfully blocked and your PC is now safe." The only activity it shows is this, nothing else. The thing is, I didn't even visit those websites on my HOST machine but only in VM. It could be that antivirus is automatically hooked into network adapter as you mentioned. Hmmm
    – Wolf G
    Mar 6, 2016 at 12:04
  • No problem. If you go into Network Connections, find the adapter and right click it and go to properties you might be able to unbind BitDefender from it.. but of course your network activity on both platforms is unprotected then. As for comments on whether AV works well, I prefer av-comparatives.org 's impartial reviews as to how effective the various products are :-). None have 100% coverage because 100% is impossible.. but there is varying quality between them all. Mar 7, 2016 at 19:34
  • Thanks for the reply Matthew but I found a solution and shared it as is. Unbinding AV from it may not be the best idea though but using external methods and disabling some features does the trick as you will find in my answer that would work against any anti-virus. I already tried with Norton, Kaspersky and Bitdefender (interestingly they all caused the same issue as BD 2016)
    – Wolf G
    Mar 7, 2016 at 20:05
  • Ah I missed that answer was from you. Masking the traffic using ToR or a VPN sounds like it's effectively your solution as you're effectively just masking the traffic so the AV product misses it. Of course you'll now struggle to find out what network activity the VM is actually doing and ToR exit nodes will now be the source of your VM's malicious activity which doesn't sound like great net-etiquette. I assumed you wanted oversight over the activity so you could packet capture and audit but I'm glad you've found a solution that works for you :-). Mar 7, 2016 at 20:12
  • Hehe :) I know it's terrible in some scenarios to use ToR for such as you mentioned but my host machine is not something I worry about since the HDD is encrypted with all its information and backed up to 2 external USBs :) What you need is a good ol' clean lab where you can make awful lots of things but thanks though. VPN was a great hint but as I mentioned, my goal is to cause as much damage as possible to for obvious reasons ;)
    – Wolf G
    Mar 7, 2016 at 20:18

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .