Is it possible to have a virus on the raspi?

---

Hello all,

I have a question. Is it somehow possible that i have a virus on my pi?
I only installed raspbian jessie and pimatic all through trusted servers.
I ask this because my provider disconnected my internet again. I only have 1 laptop 2 iphones, 2 ipads and the raspberry pi running.

Sure it is possible but the Chance is verry low.
Is the Laptop running with Windows? If so I think the Virus is on the Laptop.

@derksuh said in Is it possible to have a virus on the raspi?:

I ask this because my provider disconnected my internet again.

Again?
Was the raspi the previous time also connected or not? That would even more prove that it is the windows laptop

Did your provider mention which virus you have? (Did they mention you have a virus at all b.t.w.?)

@Harry-van-der-Wolf i called my provider and they told me that a device from my ip address send a lot of emails… I also have a NAS server running but did not open up a port for the NAS. I only opened up a port for the raspberry. The laptop is protected against viruses. I’m currently not at home but wil scan tonight.

Yes the raspberry was also connected last time. The last time i scanned the laptop for viruses and malware and did find malware.

Is it somehow possible to scan my network with my laptop to find any viruses?

@derksuh said in Is it possible to have a virus on the raspi?:

@Harry-van-der-Wolf i called my provider and they told me that a device from my ip address send a lot of emails… I also have a NAS server running but did not open up a port for the NAS. I only opened up a port for the raspberry. The laptop is protected against viruses. I’m currently not at home but wil scan tonight.

Yes the raspberry was also connected last time. The last time i scanned the laptop for viruses and malware and did find malware.

Is it somehow possible to scan my network with my laptop to find any viruses?

iOS unlikely, linux unlikey, windows… Almost always.

Scan your windows with hitman pro, free download available with free license for a month

http://www.surfright.nl/en/hitmanpro

As an extra you can also run malwarebytes.

What router do you have? One with custom firmware?

A number of questions:

• Did you configure an mail server on the raspi? To send mails from pimatic or from your system?
• And if you did what mail domain is it using? Are you using your own (dynamic) domain behind the provides domain? Are you therefore “blacklisted”? (My provider doesn’t allow that and I was once blacklisted)
• Do you receive a lot of mails and do you auto-forward these mails to another email address? Not from the mail server but from your pop3-client on your laptop for example?

@Harry-van-der-Wolf

• No i did not setup an email account on the raspi
• I did not setup a pop3 mail account on my computer as far as i know i’m only using hotmail and gmail
  through the browser

In that case I think you have a mailbot on your Windows system. Some mailbots “survive” your anti-virus scans. Please google for “mailbot” and “spambot” and check whether your windows laptop is infected despite your virus scanner.

A virus perhaps unlikely but what if someone took over your pi?
Did you open a port on the router to allow access from outside?
Did you change the standard username and password?

@rikki78 I did open up a port. But i also did change the standard user name and password

Which port is that? Did you remove the standard user and reboot the pi?

port 82 and yes i did reboot the pi and had to login again on the webinterface withthe new password

Hmm then it seems unlikely. Can you monitor where the traffic comes from perhaps?

@rikki78 no i don’t know how to do that. My provider only tells me it comes from my ip-address.

maybe one of these tools will help
http://www.techrepublic.com/blog/five-apps/five-free-dead-easy-ip-traffic-monitoring-tools/

@derksuh said in Is it possible to have a virus on the raspi?:

port 82 and yes i did reboot the pi and had to login again on the webinterface withthe new password

It seems indeed unlikely that someone took over unless someone “listened” in on your unencrypted http traffic and intercepted your userid/password.

And then you have to have the ssh port or the like open and your debian userid/password should be the same as your pimatic userid/password.

Or the hacker knows pimatic and knows how to install software via the rules (which is actually dead easy as pimatic runs under root).

All quite unlikely but definitely a reason to use http ssl if you open up pimatic to the outside world.

For all users!!

http://www.cyberciti.biz/faq/dirtycow-linux-cve-2016-5195-kernel-local-privilege-escalation-vulnerability-fix/

If you are on debian like most raspi’s here, you can easily fix it.If you were already attacked: this will not fix it.

Note: I placed it here to inform users. The mentioned vulnerability in the article might be totally unrelated to the issue mentioned in this thread, but as soon as a vulnerability gets attention, hackers start to try out.

thx harry for that important security information!!