Virus in VM not safe

Discussions about using Windows guests in VirtualBox.
Post Reply
zapper067
Posts: 3
Joined: 1. Oct 2011, 12:29
Primary OS: MS Windows XP
VBox Version: OSE other
Guest OSses: DP,7,XP,98se,NT,CE

Virus in VM not safe

Post by zapper067 »

88.perfectexe.com (60.190.223.60) attacked my real computer and the modem after a VM went to 5 dangerous sites when I tried a virus creator at http://www.youtube.com/watch?v=AiEI1KU3U7s .Why is my computer attacked as well?After switching the off the VM,they stopped attacking.For safety reasons,I deleted the VM(files as well).I thought VM is like a sandbox?Why my computer is also in risk?
mpack
Site Moderator
Posts: 39134
Joined: 4. Sep 2008, 17:09
Primary OS: MS Windows 10
VBox Version: VirtualBox+Oracle ExtPack
Guest OSses: Mostly XP

Re: Virus in VM not safe

Post by mpack »

I note that you have provided zero information about the configuration of your guest. Is networking enabled? If so what kind? (NAT, bridged, hostonly?). Have you set up shared folders?

Anyway, why the concern about an "attack"? Did the attack succeed? If you are on the same network as an infected machine then of course you can be attacked. A successful attack will however require appropriate mechanisms to be installed on both host and guest. If you don't know what those mechanisms are then I suggest you stop downloading viruses to your PCs (virtual or otherwise).
Sasquatch
Volunteer
Posts: 17798
Joined: 17. Mar 2008, 13:41
Primary OS: Debian other
VBox Version: VirtualBox+Oracle ExtPack
Guest OSses: Windows XP, Windows 7, Linux
Location: /dev/random

Re: Virus in VM not safe

Post by Sasquatch »

Some viruses are written to try to infect every system in the subnet. So it doesn't matter if you're on NAT or Bridged, the Host is accessible on both network types. Just proves you need to protect your Host and Guest, not just one or the other.
Read the Forum Posting Guide before opening a topic.
VirtualBox FAQ: Check this before asking questions.
Online User Manual: A must read if you want to know what we're talking about.
Howto: Install Linux Guest Additions
Howto: Use Shared Folders on Linux Guest
See the Tutorials and FAQ section at the top of the Forum for more guides.
Try searching the forums first with Google and add the site filter for this forum.
E.g. install guest additions site:forums.virtualbox.org

Retired from this Forum since OSSO introduction.
mpack
Site Moderator
Posts: 39134
Joined: 4. Sep 2008, 17:09
Primary OS: MS Windows 10
VBox Version: VirtualBox+Oracle ExtPack
Guest OSses: Mostly XP

Re: Virus in VM not safe

Post by mpack »

Sasquatch wrote:So it doesn't matter if you're on NAT or Bridged, the Host is accessible on both network types. Just proves you need to protect your Host and Guest, not just one or the other.
Accessible perhaps, but in order for a virus to be attached to a host file there must be a mechanism that allows writes access to an executable file. Other than shared folders, I don't know of any network mechanism which can do this. Also, when asking why a host PC comes under network attack, I think it is quite relevant whether the outside world would see host and guest as a single PC (NAT), or as separate PCs (bridged), or not connected to the outside world at all (hostonly).
Sasquatch
Volunteer
Posts: 17798
Joined: 17. Mar 2008, 13:41
Primary OS: Debian other
VBox Version: VirtualBox+Oracle ExtPack
Guest OSses: Windows XP, Windows 7, Linux
Location: /dev/random

Re: Virus in VM not safe

Post by Sasquatch »

mpack wrote:in order for a virus to be attached to a host file there must be a mechanism that allows writes access to an executable file. Other than shared folders, I don't know of any network mechanism which can do this
There are default shares available in Windows which can be abused for this. Dcom bindings can also be misused for access to Windows. And don't forget about the countless bugs the OS has that can be potentially exploited.
mpack wrote:Also, when asking why a host PC comes under network attack, I think it is quite relevant whether the outside world would see host and guest as a single PC (NAT), or as separate PCs (bridged), or not connected to the outside world at all (hostonly).
I don't think that is relevant when the attach comes from an infection on the Guest. The Host would just be another system on it's subnet and it will attack that system. As far as the virus concerns, it doesn't care if it's on NAT, bridged or Host-Only. It scans the infected system subnet and attacks any IP that can be attacked with what it's written for.
Read the Forum Posting Guide before opening a topic.
VirtualBox FAQ: Check this before asking questions.
Online User Manual: A must read if you want to know what we're talking about.
Howto: Install Linux Guest Additions
Howto: Use Shared Folders on Linux Guest
See the Tutorials and FAQ section at the top of the Forum for more guides.
Try searching the forums first with Google and add the site filter for this forum.
E.g. install guest additions site:forums.virtualbox.org

Retired from this Forum since OSSO introduction.
Post Reply