Do not take it the wrong way neither as a personal attack but I'm fade up with all this boring stuff about VM side effect when it comes to test something or investigate potential issue.
Except if you do understand the very detail and master it, I would suggest you do not start with VM but rather bare installation.
Once everything works as expected, if it appears that VM fits your needs, let's go VM but do not involve it in the picture if you don't understand whether it could have or not side effect on what you are testing.
Back to your problem:
I've installed http proxy and anti-virus on my sandbox server.
Grrrr ! proxy will not start if "users & groups" is not installed
f*%#!? I don't want to authenticate
Anyway, I installed it and started HTTP proxy and made some tests.
Indeed, I can get eicar test file without any warning
Investigating further, I discover that dansguardian is not running. I don't know why yet.
Looking at /stubs/squid, dansguardian conf will definitely trigger clam to check for virus but I don't have any dansguardian process running and restarting proxy doesn't restart dansguardian.
On the other hand, there is this undocumented "external-proxy" stuff.
Anyone having perform some reverse engineering to understand what's behind such design ? I never got an answer from Zentyal staff
I'm looking at this right now.