There are two lines of thought here. One is to let the virtual machine become infected and you can delete it and make a new one learning what you allowed and the next time you don't do that. The next is that you may invest too much into the VM so you not only BACKUP THAT COPY but add an antivirus in that VM.
Exactly when is up to you and your plan.
But given it is Windows no antivirus protects the machines. Proof is all around us so let's get done to it. We are the protection. If we install cracks and such then we get to bear the consequences. I've running into some that think the antivirus should kick in and stop us from doing the OS in.
Bob
When in virtual pc on Xp should I install antivirus part in xp in the virtual pc or one in Windows 7 protecting me.

Chowhound
Comic Vine
GameFAQs
GameSpot
Giant Bomb
TechRepublic