Getting infected by inserting an ISO to a virtual machine?

Question

I have Windows 7 Professional on my computer, and I wanted to try Home Premium as a virtual machine to feel the defference between them. The ISO is from Microsoft's original website, from the days when they offered disk images to be downloaded for free, the SHA-1 code still matches.

I had no problem at installation in VirtualBox, I switched off internet connection both in host and guest machine, and did not have any shared folders. I wanted to protect my virtual machine with antivirus and antimalware programs, so I created an ISO file with the free version of WinISO Maker, that included avast, SuperAntiSpyWare and Malwarebytes Anti-Malware. After that, I inserted this ISO as a disk to the guest machine, and I was using them without any issues.

Once when I just turned back to my host machine, I recognized that some functionatily of the system has changed. I could not alt-tabbing in the normal way, when I tried to click an item on the taskbar, that item opened up multiple times instead of swithcing to it, clicking onto desktop caused highlighting random icons there, my caps lock key worked inversely, and I could not get into task manager, simply it was not opening, etc... Since the problems remained even when closing VirtualBox and I felt that I slowly loose control over my system, I restored my computer to an earlier state, and uninstalled VirtualBox with all its virtual machines as well, though VirtualBox was up-to-date, too, and no infections were reported anywhere.

I wonder why all of these things happened?
Could it be a virus?
- Could it be because I gave a disk image into the guest machine, and it was working with it, so infection could spread from that file over my host machine?
- If the guest machine is an untouched copy, and internet connection was closed both for host and guest machine, how could such an infection get into the system?
- All the programs I used was trusted, downloaded from their original websites..

If not a virus what could it be?
What could have happened there?
I am a bit afraid to try again in case the problems will re-occur or not..
Every answer will be appreciated, thank you for all in advance!

Answer 1

None of this sounds particularly prone to suggest infection. Back in the 1980s, skilled programmers would do things like play music to demonstrate their mastery over a PC. Today, most common malware distributed over the Internet is financially motivated, so symptoms are things like stealing data, inserting back doors, etc. Many of the most effective viruses try hard to not get detected.

When using a virtual machine, sometimes people want Alt-Tab to affect the virtual machine, not the host machine. So it's not too surprising that you might notice a change in that behavior.

My best guess: You may have installed something called "Guest Extensions" (or some similar name), which helps the virtual machine to integrate nicely with the host machine. For instance, such extensions may include a custom mouse driver that lets you have just one mouse cursor seamlessly affect both machines.

Or it may be a lack of guest extensions. When you held down the shift key, your system noticed it. When you let go of the shift key, that information was transmitted to the guest operating system. As a result, it feels like Caps Lock is toggled.

Check your "Add/Remove Programs" section (whatever it's called... In Windows 7 it may be "Programs and Software" or something like that, in the Control Panel). See if there's a separate program called something like "VirtualBox Host Extensions", which may be different than just the main base program.

Otherwise, keep researching. But I feel like you can probably do that rather calmly, rather than panicked.

Answer 2

If you have programs installed for mouse and keyboard, try uninstalling them from add/remove programs and let them run on the Windows default drivers. Reboot.

Also check for filter drivers. Instructions - Open Regedit, and then navigate to the following key:

SYSTEM\CurrentControlSet\Control\Class\{4D36E96B-E325-11CE-BFC1-08002BE10318} 

Export this key and save in the odd chance it is needed again to restore operation. Double-click the UpperFilters remove all entries except kbdclass.

Navigate to the following registry location:

SYSTEM\CurrentControlSet\Control\Class\{4D36E96F-E325-11CE-BFC1-08002BE10318}

Export this key and save in the odd chance it is needed again to restore operation. Double-click the UpperFilters remove all entries except mouclass Exit Regedit. Restart PC