As I was thinking to reinstall a Host Operating system (homesystem), I asked myself if the VMs running on the host shouldn't be deleted and reinstalled too. Assuming malware (backdoors) and so on could haunt inside the VMs.

Could the VMs be used to infect the Host System and is there a standard behavior on how to manage the VMs, e.g deleting or using backups (if the first) or reverse engineering?

I read also this topic here.

closed as unclear what you're asking by Marcus Müller, Xander, Matthew, kasperd, grochmal Dec 8 '16 at 1:55

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • If you're wiping the entire host system, doesn't that include everything stored on it, including any VMs? – Xiong Chiamiov Dec 6 '16 at 21:09
  • I have backups that I did recently. – Tech-IO Dec 6 '16 at 21:26
  • 2
    @GiaRui "wiping something" obviously means "Not restoring it from backup immediately after" – Marcus Müller Dec 6 '16 at 21:36
  • @GiaRui anyway, you're asking multiple things in one question. "Can VMs infect my host system?", "should I delete my VMs, too?". It's however neither clear why you wipe your host nor why you'd want to wipe your guest systems, so no-one can help you – Marcus Müller Dec 6 '16 at 21:37
  • 1
    Yes sorry. Assuming that the Host is compromised as well as the vm's. Maybe the backups are also infected. Thanks – Tech-IO Dec 6 '16 at 21:48

It is possible for the guest VM's to be infected if the malware either understands how to control the guest or there is a live connection between the host and guest - e.g using a "shared" drive or network drive.

The first is unlikely, the second is reasonably likely.

So if you can easily share data between the host and the guest, you should probably assume that the guest is compromised - assuming that it was running when the malware was.

It is theoretically possible that malware could also directly infect a virtual disk but again unlikely, I'm not aware of any.

If you are using VM's, it is common and sensible to take a snapshot of the VM and drives after initial setup. Write that to CD/DVD or pen drive and keep it offline until needed.

As for the VM infecting the host, the same logic applies.

If you want to experiment with malware on a VM, you need to ensure that there is minimal contact between the VM and the host. Don't share drives, don't have a shared network.

Not the answer you're looking for? Browse other questions tagged or ask your own question.