The answer should be obvious but I ask anyway.

If the host is virus infected with a keylogger and you do sensitive stuff on a virtual linux client, that information is being logged by the keylogger. So if the Host is infected, using a VM is useless, right?

What options do I have, beside an anti virus/malware, a new partition with another OS on it and a completely different computer?

  • 3
    I would have thought malware removal would have been your first option. Why are you looking for options other than those you listed anyway? Are you in a hurry to get something done? If so, something like a Linux LiveCD might be your best bet. – Karan Nov 5 '12 at 15:02

If the host is infected, it's game over. The host O/S sees everything, and even if it's told to ignore things (i.e., redirecting a USB device to the VM), the host can still monitor/log that data. Your options are: use another computer, reinstall your OS, use A/V software, or use a LiveCD.

You can try to remove the virus/malware with A/V or another program to clean the system (possibly from a live CD), but to be completely honest it is virtually impossible to guarantee any sort of security after a system has been compromised. There are just too many places and ways for malicious code to hide in a system where A/V and other tools can't detect or clean them out. If this is a business environment where you have security liabilities, or a personal computer with banking details, facebook login cookies or other fun things that a hacker would like to have, then back up your files (make sure they're clean, or you'll just get the virus again) and format and start over.


I've found that if you use USB keyboard and redirects it to the VM the host is not aware of it... Not as a keyboard anyway... I've done this using Virtual Box, so I suppose it's possible with other VMs.

  • The host sees and can intercept anything. Just because it's being ignored, doesn't mean it can't be monitored. – Darth Android Nov 5 '12 at 15:07
  • The keyboard buffer is being redirected this of course means any application on the host can view and record the buffer if it wants. – Ramhound Nov 5 '12 at 15:25
  • Of course the host can intercept anything and there are no guarantees, but it's not just being ignored and it's just the buffer that's being redirected. It the port itself. I've just tried it.I ran a standard keylogger (uses Hook API) and redirected the usb keyboard to my VM - the keylogger recorded nothing. – EliadTech Nov 6 '12 at 6:11

Not the answer you're looking for? Browse other questions tagged or ask your own question.