The way a computer "accesses Internet" is through a tower of systems, each using the one underneath. Schematically, it works like this:
An application, let's say Internet Explorer, decides to access a given URL, like
http://www.example.com/. IE must first contend with its loadable modules: all the extra plugins which can be loaded into IE and may make arbitrary things with it. For now, I assume that no such plugin decided to do funky things. IE will access the URL.
This involves talking to the machine which has the name
www.example.com but its proxy settings may instruct it to talk instead to a dedicated proxy machine, in which case IE will want to talk to the proxy machine. I assume here that there are no such proxy settings.
Since the Internet uses IP addresses, the name (
www.example.com) must first be translated to an IP address. This is a matter of using the DNS. In practice, IE uses one of the system DLL, which itself may talk to other DLL or other process on the machine, depending on your OS and the local DNS configuration. Ultimately, one of these components needs to send packets to the outside world and receive responses:
- The request (an UDP packet) is wrapped into an IP packet; this is handled somewhere in the kernel.
- The local firewall rules are checked, to see if the packet is "allowed".
- The ARP cache is checked for knowledge of the MAC address of the next router (your home router, the modem provided by your ISP...). If not, some extra frames must be exchanged over the wire (or air, if using WiFi).
- All the frames to be sent and received go through the driver for the network interface which enacts the necessary magic. The driver is a software components loaded into the entrails of the OS (into the kernel, directly).
- The response (if any) will follow the same path in reverse: driver, firewall, unwrapping, UDP packet to the DNS handling process, then sent to the waiting Internet Explorer.
When IE obtains the (purported) IP address for
www.example.com, it initiates a TCP connection to that server. This again uses a lot of IP packets which all go through the layers exposed above. Once the TCP connection is established, IE sends the HTTP request and expects the HTTP response, which involves more IP packets.
The plugins may yet again interfere. If they do not, IE converts the received request into something which can be displayed to the user. The actual display goes through the window management and display driver of the operating system. Ultimately, the user "sees" the page.
An Internet-blocking malware can insert itself at any place in all this mechanism. The malware may be a loadable module in IE; it may alter the proxy settings; it may change the DNS configuration; it may disrupt transmission in the firewall settings; it may act as a pseudo-driver for the network interface; it may even fiddle with the display driver (some SSO do it to recognize password-entry popups, so malware can do it, too).
If you can access the Internet from your VM, then this means that the VM plugs itself at deeper layer than the malware. For instance, Virtualbox, when using "bridged networking", acts at the network interface driver level; it thus bypasses the upper layers (modules, proxy, DNS, firewall) and is unaffected by whatever the malware may have done to them.
Of course, the plausible scenario is not that the malware wanted to wantonly block your Internet; instead, it was probably trying to insert itself inconspicuously in the traffic, so as to promote its own nefarious schemes, like displaying ad popups or relaying spam. That your Internet is blocked probably means that the malware failed and broke the OS instead of leeching on it discreetly.
So you not only got infected by some malware; you got infected by some incompetent malware.
Usual recommendations apply nonetheless: save your data on a USB drive, nuke the machine (reformat, reinstall from scratch), install an antivirus/malware (e.g. the one from Microsoft), plug the USB drive, scan it with the antivirus, then finally copy back your data. This will take the better part of a week-end...