Sign up ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

If I am running a Windows 7 virtual machine on a Windows 7 host using VMWare or VirtualBox (or anything else) and the virtual machine is completelly overloaded with viruses and another malicious code, should I worry about my host machine?

If I have an anti-virus program on host machine will it detect any problems?

share|improve this question

4 Answers 4

up vote 28 down vote accepted

What every answer has missed so far is that there are more attack vectors than just network connections and file sharing, but with all the other parts of a virtual machine - especially in regards to virtualizing hardware. A good example of this is shown below (ref. 2) where a guest OS can break out of the VMware container using the emulated virtual COM port.

Another attack vector, commonly included and sometimes enabled by default, on almost all modern processors, is x86 virtualization. While you can argue that having networking enabled on a VM the biggest security risk (and indeed, it is a risk that must be considered), this only stops viruses from being transmitted how they are transmitted on every other computer - over a network. This is what your anti-virus and firewall software is used for. That being said...

There have been outbreaks of viruses which can actually "break out" of virtual machines, which has been documented in the past (see references 1 and 2 below for details/examples). While an arguable solution is to disable x86 virtualization (and take the performance hit running the virtual machine), any modern (decent) anti-virus software should be able to protect you from these viruses within limited reason. Even DEP will provide protection to a certain extent, but nothing more then when the virus would be executed on your actual OS (and not in a VM). Again, noting the references below, there are many other ways malware can break out of a virtual machine aside from network adapters or instruction virtualization/translation (e.g. virtual COM ports, or other emulated hardware drivers).

Even more recently is the addition of I/O MMU Virtualization to most new processors, which allows DMA. It does not take a computer scientist to see the risk of allowing a virtual machine with a virus direct memory and hardware access, in addition to being able to run code directly on the CPU.

I present this answer simply because all of the other ones allude you to believe that you just need to protect yourself from files, but allowing virus code to directly run on your processor is a much bigger risk in my opinion. Some motherboards disable these features by default, but some don't. The best way to mitigate these risks is to disable virtualization unless you actually need it. If you aren't sure if you need it or not, disable it.

While it is true that some viruses can target vulnerabilities in your virtual machine software, the severity of these threats is drastically increased when you take into account processor or hardware virtualization, especially those that require additional host-side emulation.

  1. How to recover virtualized x86 instructions by Themida (Zhenxiang Jim Wang, Microsoft)

  2. Escaping VMware Workstation through COM1 (Kostya Kortchinsky, Google Security Team)

share|improve this answer
Thanks, you got the best and most complete answear until now (which includes references and some theory base about the subject). Thank you. –  Diogo Jul 8 '11 at 20:18
The article linked from the text "has been documented in the past" is nothing to do with breaking out of a VM. (it's about x86 virtualization for malware obfuscation, and the reverse-engineering of such) –  Hugh Allen Aug 6 '11 at 13:20
@HughAllen just read the article and was going to comment the exact same thing. Doesn't exactly instill confidence that the answerer knows what he/she is talking about, does it? –  Brett May 19 at 10:46
@HughAllen I've added a new example to show that these issues are indeed real. In this case the exploit deals specifically with VMWare, but you can easily find other disclosures on various security websites. –  Breakthrough Jun 21 at 4:16
@Brett I think the OP mentioned the visualization article to show that the interpreter/translator itself can be abused to manipulate what instructions are being executed host-side. Also note that's just an abstract/summary of the article itself and not the full article. I can't seem to find a full version, but will post here if I manage to find a copy. –  Breakthrough Jun 21 at 4:17

If you're using shared folders or have any kind of network interaction between the VM and the host then you have something to potentially worry about. By potentially, I mean that it depends on what the malicious code actually does.

If you don't use shared folders and don't have any kind of networking enabled you should be fine.

Anti-virus on your host machine will not do any kind of scanning within your VM unless you have things shared.

share|improve this answer
I think the OP was asking if the anti-virus would detect anything that made it’s way out to infect the host, in which case, it should (if it is something that the AV can detect). As for being safe if isolated, there is definitely software that can detect being inside a VM (the VM’s tools for one, but also look up “redpill vm”), and there is work (and possibly actual malware by now) that can jump out of a VM (look up “bluepill vm”). –  Synetech May 30 '11 at 17:28
While this is true, you forgot about what happens when you have x86 virtualization enabled. There are viruses that exist which can break out of your virtual machine this way, regardless of whether or not you even have a network controller installed on the VM. –  cp2141 Jul 8 '11 at 18:47
It should also be noted that virtual machines do a lot more emulation/virtualization than just network connections (e.g. breaking out of a VM through the emulated virtual COM port), providing a lot more vectors to attempt to control the host system. –  Breakthrough Jun 21 at 4:30

If the VM is infected with a virus that is targeted at exploiting the VM Software like VMWare Tools it could possible get out but I don't think anything out there is capable of this at the moment. It could also exploit the host over the network if the host is vulnerable.

The anti-virus on the host system should not see viruses in the VM unless they are sitting on a shared folder.

share|improve this answer
There are a handful of exploits floating around that do this. One could dig through the VMware Security Advisories alone and find a few: Other vendors also have issues. –  Brad May 27 '11 at 19:47
@Brad, The landscape is way too small. Of course there would be VMware specific viruses, they are asking for it by taking the whole pie to themselves. –  Pacerier Apr 22 at 6:27

Should be fine, just turn off access to file sharing and kill the nic inside the VM after the initial infection period.

share|improve this answer

protected by Diogo Oct 10 '13 at 14:37

Thank you for your interest in this question. Because it has attracted low-quality answers, posting an answer now requires 10 reputation on this site.

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.