[Py_Dev]

Ok, so if you are like me, everything is on your virtual machine. This is then hosted on your normal pc. I wrote this script in a situation where I'd need my Oracle Virtual box completely wiped and unrecoverable.


You will need sdelete. Download it HERE
*Place sdelete in your system32.

Code

import os
import shutil
import subprocess
import winreg
import ctypes
import time


def is_admin():
    try:
        return ctypes.windll.shell32.IsUserAnAdmin()
    except:
        return False


def secure_delete_directory(directory):
    if os.path.exists(directory):
        for root, dirs, files in os.walk(directory, topdown=False):
            for name in files:
                try:
                    os.remove(os.path.join(root, name))
                except:
                    pass
            for name in dirs:
                try:
                    os.rmdir(os.path.join(root, name))
                except:
                    pass
        shutil.rmtree(directory, ignore_errors=True)
        print(f"[+] Securely deleted directory: {directory}")


def uninstall_virtualbox():
    try:
        print("[+] Uninstalling VirtualBox...")
        subprocess.run(["powershell", "Start-Process msiexec -ArgumentList '/x {B41DB860-8EE4-4F03-BA50-51E194C426D7} /quiet /norestart' -NoNewWindow -Wait"], shell=True)
        print("[+] VirtualBox Uninstalled.")
    except Exception as e:
        print(f"[-] Error uninstalling VirtualBox: {e}")


def remove_registry_keys():
    keys = [
        r"SOFTWARE\Oracle\VirtualBox",
        r"SOFTWARE\WOW6432Node\Oracle\VirtualBox",
        r"SYSTEM\CurrentControlSet\Services\VBoxDrv",
        r"SYSTEM\CurrentControlSet\Services\VBoxNetAdp",
        r"SYSTEM\CurrentControlSet\Services\VBoxNetLwf",
        r"SYSTEM\CurrentControlSet\Services\VBoxUSBMon"
    ]
    
    for key in keys:
        try:
            winreg.DeleteKey(winreg.HKEY_LOCAL_MACHINE, key)
            print(f"[+] Deleted registry key: {key}")
        except FileNotFoundError:
            pass
        except Exception as e:
            print(f"[-] Error deleting {key}: {e}")


def clear_logs():
    try:
        log_dirs = [
            os.path.expanduser("~\\VirtualBox VMs"),
            os.path.expanduser("~\\.VirtualBox")
        ]
        
        for log_dir in log_dirs:
            secure_delete_directory(log_dir)

        print("[+] Clearing Windows Event Logs related to VirtualBox...")
        subprocess.run(["wevtutil", "cl", "Microsoft-Windows-Hyper-V-VMMS/Admin"], shell=True)
        subprocess.run(["wevtutil", "cl", "Microsoft-Windows-Hyper-V-Worker/Admin"], shell=True)
        print("[+] Logs cleared.")
    
    except Exception as e:
        print(f"[-] Error clearing logs: {e}")


def wipe_free_space():
    sdelete_path = r"C:\Windows\System32\sdelete64.exe"  # Full path to sdelete64.exe
    
    try:
        print(f"[+] Wiping free disk space using {sdelete_path} (7-pass)...")
        subprocess.run([sdelete_path, "-p", "7", "-z", "C:\\"], shell=True)
        print("[+] Free space wiped securely using SDelete64.")
    except Exception as e:
        print(f"[-] Error using SDelete64: {e}")
        print("[!] Running Windows cipher command as a fallback...")
        subprocess.run(["cipher", "/w:C:\\"], shell=True)
        print("[+] Cipher completed disk wipe.")



if __name__ == "__main__":
    if not is_admin():
        print("[-] Please run this script as Administrator.")
        exit(1)

    print("=== VM NUKE: PERMANENTLY REMOVING VIRTUALBOX ===")
    time.sleep(2)
    
    uninstall_virtualbox()      # Step 1: Uninstall VirtualBox
    remove_registry_keys()      # Step 2: Remove registry entries
    clear_logs()                # Step 3: Clear logs and wipe files
    wipe_free_space()           # Step 4: Wipe free space on disk

    print("[+] VirtualBox and all traces have been completely destroyed.")

[Juninho]

Top demais meu mano, Continue assim meu mano

[Charlie Sheen]

Top demais meu mano, Continue assim meu mano

All posts must be made in English. Please read our Help Docs.

[Pr0m3th3us]

Amazing. How did you test this though?

Also will this work in windows powershell and Linux terminal both?

[Py_Dev]

tested this and is in fact working..