Virtual machine security

1. A method for managing antivirus scans in a virtualized environment, the method comprising the steps of:

scheduling a scan of a first virtual machine at a predetermined time with a hypervisor for a plurality of virtual machines including the first virtual machine and a security virtual machine, the scan including a rootkit scan;

transmitting, at the predetermined time, an antivirus tool including a rootkit scanner and a rootkit removal tool from the security virtual machine to a guest agent on the first virtual machine;

installing the antivirus tool on the first virtual machine with the guest agent;

restarting the first virtual machine;

executing the antivirus tool on the first virtual machine;

detecting, by the rootkit scanner, rootkits using at least one of behavioral-based methods, signature-based methods, and difference-based methods;

executing the rootkit removal tool on the first virtual machine when a rootkit is detected;

uninstalling the antivirus tool, including the rootkit scanner and the rootkit removal tool, from the guest agent on the first virtual machine, the uninstalling of the antivirus tool freeing up at least one of memory or processing capacity on the first virtual machine; and

restarting the first virtual machine.

2. The method of claim 1 further comprising transmitting an execution status for the antivirus tool from the guest agent to the security virtual machine.

3. The method of claim 1 wherein uninstalling the antivirus tool frees up data storage capacity on the first virtual machine.

4. A system comprising:

a data store including a computer readable medium storing a plurality of tools including an antivirus tool, the antivirus tool including a rootkit scanner and a rootkit removal tool;

a first virtual machine hosted on a first physical device including a first memory and a first processor, the first virtual machine including a guest agent configured to receive one of the plurality of tools from a security virtual machine; and

a hypervisor hosted on a second physical device including a second memory and a second processor, the hypervisor for managing a plurality of virtual machines including the first virtual machine and the secure virtual machine, the hypervisor configured to schedule a scan of the first virtual machine with the antivirus tool at a predetermined time, wherein the secure virtual machine and the first virtual machine are configured by computer executable code to perform the steps of:

transmitting the antivirus tool from the security virtual machine to the first virtual machine at the predetermined time,

installing the antivirus tool on the first virtual machine,

detecting, by the rootkit scanner, rootkits using at least one of behavioral-based methods, signature-based methods, and difference-based methods,

executing the rootkit removal tool on the first virtual machine to perform an antivirus scan of the first virtual machine when a rootkit is detected, and

removing the antivirus tool, including the rootkit scanner and the rootkit removal tool, from the first virtual machine, the removal of the antivirus tool freeing up at least one of memory or processing capacity on the first virtual machine.

5. The system of claim 4 wherein the antivirus tool includes a rootkit scanner.

6. The system of claim 4 wherein the antivirus tool includes a scanning specific tool customized for the first virtual machine.

7. The system of claim 4 wherein the antivirus tool includes a full antivirus application.

8. The system of claim 4 wherein installing the antivirus tool includes executing an installer on the first virtual machine.

9. The system of claim 4 wherein installing the antivirus tool includes unpacking the antivirus tool and one or more associated files.

10. The system of claim 4 wherein installing the antivirus tool includes restarting the first virtual machine.

11. The system of claim 4 wherein removing the antivirus tool includes restarting the first virtual machine.

12. The system of claim 4 wherein the first physical device is remote from the second physical device.

13. The system of claim 4 wherein removing the antivirus tool frees up data storage capacity on first virtual machine.

14. A computer program product for managing antivirus scans in a virtual environment, the computer program product comprising computer executable code embodied in a non-transitory computer readable medium that, when executing on one or more computing devices, performs the steps of:

scheduling a scan of a first virtual machine at a predetermined time with a hypervisor for a plurality of virtual machines including the first virtual machine and a security virtual machine;

at the predetermined time, transmitting an antivirus tool from the security virtual machine to the first virtual machine, the antivirus tool including a rootkit scanner and a rootkit removal tool;

installing the antivirus tool on the first virtual machine;

detecting, by the rootkit scanner, rootkits using at least one of behavioral-based methods, signature-based methods, and difference-based methods;

executing the rootkit removal tool on the first virtual machine when a rootkit is detected; and

uninstalling the antivirus tool, including the rootkit scanner and the rootkit removal tool, to free up at least one of memory or processing capacity on the first virtual machine.

15. The computer program product of claim 14 wherein the computer program product further comprises code that executes on the first virtual machine to perform the steps of:

receiving a rootkit scanner at the first virtual machine;

installing the rootkit scanner;

uninstalling the rootkit scanner; and

reporting a result of the rootkit scanner to the secure virtual machine.

16. The computer program product of claim 14 wherein uninstalling the antivirus tool frees up data storage capacity on the first virtual machine.