My computer was recently infected by some malware which had blocked internet access. I had a virtualization software with an OS in it. Surprisingly, I could access the internet from the VM. I know nothing about VM's and all the stuff that happens behind-the-scenes when i connect to the internet. But, i did not expect this to be possible.
Can someone explain how it was possible for me to connect to the internet via VM ?
It can very well be that your NIC of your VM is bridged to your physical machine, which means the firewall rules which apply to your physical machine, may not apply for your VM.
Nowadays malware is no longer trying to break your computer on purpose or play mean jokes on people. So it is very probable that malware changed your settings in order to intercept and maybe change your traffic. Those changes might have had bugs or maybe the authors stopped the entire operation like it was the case with DNSChanger. There are a couple of popular ways malware will interfere with your internet access:
A new OS in a virtual machine wouldn't be affected by most of these changes because it would be connected directly to the network. This mode is called bridged mode and the computer in the virtual machine acts like a new computer on the network. There is one other mode of connecting to the internet and it is called NAT mode where your host computer acts like a router for your virtual machine.
Here are resources where you can read more:
Friendly advice: Google will not provide exact answers to your questions but int time, you will learn how to find information and answer your own questions better than this website will.
The way a computer "accesses Internet" is through a tower of systems, each using the one underneath. Schematically, it works like this:
An application, let's say Internet Explorer, decides to access a given URL, like http://www.example.com/. IE must first contend with its loadable modules: all the extra plugins which can be loaded into IE and may make arbitrary things with it. For now, I assume that no such plugin decided to do funky things. IE will access the URL.
This involves talking to the machine which has the name www.example.com but its proxy settings may instruct it to talk instead to a dedicated proxy machine, in which case IE will want to talk to the proxy machine. I assume here that there are no such proxy settings.
Since the Internet uses IP addresses, the name (www.example.com) must first be translated to an IP address. This is a matter of using the DNS. In practice, IE uses one of the system DLL, which itself may talk to other DLL or other process on the machine, depending on your OS and the local DNS configuration. Ultimately, one of these components needs to send packets to the outside world and receive responses:
When IE obtains the (purported) IP address for www.example.com, it initiates a TCP connection to that server. This again uses a lot of IP packets which all go through the layers exposed above. Once the TCP connection is established, IE sends the HTTP request and expects the HTTP response, which involves more IP packets.
The plugins may yet again interfere. If they do not, IE converts the received request into something which can be displayed to the user. The actual display goes through the window management and display driver of the operating system. Ultimately, the user "sees" the page.
An Internet-blocking malware can insert itself at any place in all this mechanism. The malware may be a loadable module in IE; it may alter the proxy settings; it may change the DNS configuration; it may disrupt transmission in the firewall settings; it may act as a pseudo-driver for the network interface; it may even fiddle with the display driver (some SSO do it to recognize password-entry popups, so malware can do it, too).
If you can access the Internet from your VM, then this means that the VM plugs itself at deeper layer than the malware. For instance, Virtualbox, when using "bridged networking", acts at the network interface driver level; it thus bypasses the upper layers (modules, proxy, DNS, firewall) and is unaffected by whatever the malware may have done to them.
Of course, the plausible scenario is not that the malware wanted to wantonly block your Internet; instead, it was probably trying to insert itself inconspicuously in the traffic, so as to promote its own nefarious schemes, like displaying ad popups or relaying spam. That your Internet is blocked probably means that the malware failed and broke the OS instead of leeching on it discreetly.
So you not only got infected by some malware; you got infected by some incompetent malware.
Usual recommendations apply nonetheless: save your data on a USB drive, nuke the machine (reformat, reinstall from scratch), install an antivirus/malware (e.g. the one from Microsoft), plug the USB drive, scan it with the antivirus, then finally copy back your data. This will take the better part of a week-end...
