I often use VirtualBox virtual machines to solve the few cases where I still need a Microsoft Windows only application. This solution works well but is far from ideal from the security point of view. The only Windows version I still own is the not more unsupported Windows XP, so my virtual machines are an easy target to the many viruses and malware around the 'net. As general precaution I keep my virtual machines off the network by disabling their virtual network card but, in some cases, the application used might explicitly require a network connection and other infection ways exist other than the 'net. Generally speaking it would be wise to periodically check all Windows virtual machines disks for viruses.
I'm not positive about installing an anti-virus software on a virtual machine mostly because I fear the loss of the not already brilliant machine performances so I went looking for a alternative solution.
Trinity Rescue Disk
Trinity Rescue Disk is a small (very small indeed) footprint live Linux distribution specialized in broken computer recovery. Among the many useful tools it offers scanning all computer drives for viruses using five of the most common anti-virus programs. In order boot and work with Trinity Rescue Disk the virtual machine must have assigned at least 1GB of RAM. If you are experimenting with very low specs machines you'll have to temporarily change the machine memory settings.