Author Topic: can a virus in an MS Virtual PC machine infect the host PC?  (Read 16317 times)

0 Members and 1 Guest are viewing this topic.

Offline killingtime

  • Jr. Member
  • **
  • Posts: 28
  • killingtime virus...
can a virus in an MS Virtual PC machine infect the host PC?
« on: April 18, 2009, 06:06:34 AM »
Before my main laptop was taken down by win32.vitro, I had Virtual PC running with four virtual machines. Server 2003, 2 XP Pro, and 1 Ubuntu. I didn't have them backed up so I've got to start over.  :'(

Anyway, I want to try my hand at debugging a virus. Is it safe, relatively speaking, in a Virtual PC machine? Or should I look at something else? I've never tried VMWare so I don't know if it makes a better test bed for this than Virtual PC, or which VMWare "solution" to choose.

And I'm sure the answer all depends on which malware/virus is being let loose.

Any help would be greatly appreciated.  ;D

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 84912
  • No support PMs thanks
Re: can a virus in an MS Virtual PC machine infect the host PC?
« Reply #1 on: April 18, 2009, 04:42:05 PM »
Unless you have a robust Back-up and Recovery Strategy (didn't seem so in your previous experiences), then I would suggest leaving your restless hands at more productive things.

There is malware that doesn't so much cross the virtual to physical boundary, but is aparently able to avoid the virtual environment.

It also depends on the virtual environment you are using, the settings that you have set, some allow to save bookmarks, etc. to the real drive and if you have any similar setting that would be a chink in the armour. I guess the malware you come into contact with is a big factor as it would have to be one that is able to avoid the virtual environment, before you ask, I don't know.
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 21.3.2459 (build 21.3.6164.561) UI 1.0.609/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

Offline killingtime

  • Jr. Member
  • **
  • Posts: 28
  • killingtime virus...
Re: can a virus in an MS Virtual PC machine infect the host PC?
« Reply #2 on: April 19, 2009, 06:53:41 AM »
Unless you have a robust Back-up and Recovery Strategy (didn't seem so in your previous experiences), then I would suggest leaving your restless hands at more productive things.
Well, I do now.

I'm doing incremental disk images using Macrium Reflect Free Edition. I have my basic XP (with SP3 and all updates etc) on a flash drive because I couldn't get the Macrium boot CD (linux) to see my network drive. Macrium also allows you to make a BARTPE boot CD but I haven't tried this.

My main objective is to learn about virus' and the tools used to study them. I know it's playing with fire but I plan to proceed cautiously. This is productive for me. It's either this or a case of Absolut.  ;D
« Last Edit: April 19, 2009, 07:08:25 AM by killingtime »

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 84912
  • No support PMs thanks
Re: can a virus in an MS Virtual PC machine infect the host PC?
« Reply #3 on: April 19, 2009, 04:19:06 PM »
Me, there is no way I would do this on anything other than a test system and not my regular use system, but that is me.

If you do you have to accept that you may have to start from absolute scratch, fdisk, format, reinstall. I don't really know exactly what it is you want to learn about viruses, but I would advise learning in a controlled environment (no idea where this might be) and not any random way as it would be harder to actually document what happens.

But it is your system and your choice, knock yourself out.
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 21.3.2459 (build 21.3.6164.561) UI 1.0.609/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67255
Re: can a virus in an MS Virtual PC machine infect the host PC?
« Reply #4 on: April 19, 2009, 10:16:50 PM »
In theory, not. Virus on virtual environment does not go out of it and infect the hosts OS.
It does not depend on the virus, afaik.
The best things in life are free.

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 84912
  • No support PMs thanks
Re: can a virus in an MS Virtual PC machine infect the host PC?
« Reply #5 on: April 19, 2009, 10:58:41 PM »
No longer in theory, there are malware variants that can actually avoid the virtual environment.
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 21.3.2459 (build 21.3.6164.561) UI 1.0.609/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

Offline lukor

  • Avast team
  • Super Poster
  • *
  • Posts: 1879
    • AVAST Software
Re: can a virus in an MS Virtual PC machine infect the host PC?
« Reply #6 on: April 20, 2009, 09:28:40 AM »
If the virtual PC is connected by the (virtual) network with the host PC then it probably can infect it.

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67255
Re: can a virus in an MS Virtual PC machine infect the host PC?
« Reply #7 on: April 20, 2009, 02:21:18 PM »
If the virtual PC is connected by the (virtual) network with the host PC then it probably can infect it.
I'm talking about a single computer (host) running a virtual operational system (guest). The guest only uses Internet connection (virtual adapter). Will, in this case, appear any trouble?
The best things in life are free.

Offline lukor

  • Avast team
  • Super Poster
  • *
  • Posts: 1879
    • AVAST Software
Re: can a virus in an MS Virtual PC machine infect the host PC?
« Reply #8 on: April 20, 2009, 03:41:58 PM »
If the virtual PC is connected by the (virtual) network with the host PC then it probably can infect it.
I'm talking about a single computer (host) running a virtual operational system (guest). The guest only uses Internet connection (virtual adapter). Will, in this case, appear any trouble?

Can you ping your host from the virtual system? Can you connect to network shares of your host from the virtual system? If yes, then everything is similar to the situation where there would be two computers on the network, one infected and one yours - if your host system is not patched and not running firewall/antivirus and your virtual PC is running suitable virus, then YES you can be infected IMHO.

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67255
Re: can a virus in an MS Virtual PC machine infect the host PC?
« Reply #9 on: April 20, 2009, 04:44:43 PM »
Can you ping your host from the virtual system?
Do you mean my external IP address?

Can you connect to network shares of your host from the virtual system?
I have no shares, I'm on a single computer, not networked (only Internet). ???
The best things in life are free.

Offline lukor

  • Avast team
  • Super Poster
  • *
  • Posts: 1879
    • AVAST Software
Re: can a virus in an MS Virtual PC machine infect the host PC?
« Reply #10 on: April 20, 2009, 11:51:08 PM »
Can you ping your host from the virtual system?
Do you mean my external IP address?

This does not matter, be it either external or internal, if it can ping it, it can connect and you can think of it as any other hostile PC on the net (and Internet is full of those, so nothing extra special is happening here). Honestly I don't have much experience with Virtual PC, on VMWare the guest PC can be connected in 3 way, host only, bridged and NAT. All 3 modes make the connection work via special virtual adapter (with it's own IP address), packets are not read from the wire, but are generated from the vmware service. In some cases (i think its both bridged and NAT) avast! running on the HOST PC can even block traffic (if infected) originating from the Virtual PC (WebShield in Optout mode, Network shield with URL blocker).

But I am talking just theoretically. In case there is some unknown unpatched vulnerability, then yes, I personaly think virtual PC can infect the host. There is nothing in the implementation that prevents this happening.

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67255
Re: can a virus in an MS Virtual PC machine infect the host PC?
« Reply #11 on: April 21, 2009, 12:59:10 AM »
WebShield in Optout mode, Network shield with URL blocker
My case and my case... :)

There is nothing in the implementation that prevents this happening.
Glad to learn. In my ignorance, I've thought I were safe. Nothing worse to security than only security feeling...
The best things in life are free.

Offline killingtime

  • Jr. Member
  • **
  • Posts: 28
  • killingtime virus...
Re: can a virus in an MS Virtual PC machine infect the host PC?
« Reply #12 on: April 21, 2009, 06:11:12 AM »
Can you ping your host from the virtual system? Can you connect to network shares of your host from the virtual system? If yes, then everything is similar to the situation where there would be two computers on the network, one infected and one yours - if your host system is not patched and not running firewall/antivirus and your virtual PC is running suitable virus, then YES you can be infected IMHO.

In my case, I cannot ping the host from a virtual machine. Nor, can I access shares on the host.

I am using MS Virtual PC with a Server 2003 machine and an XP machine connected through a domain.

I guess this means that no virus can infect the host from my virtual machines. But it doesn't mean that it's not possible, right? Virtualization is a big deal these days and I'm sure malware writers could come up with something eventually...

edit: my virtual server 2k3 see's all my host's workgroup shares.  :(
« Last Edit: April 22, 2009, 10:03:33 AM by killingtime »