525 5.7.13 Authentication Denied (VM305)

[Davidlawuk]

I previously asked about getting the login screen when sending emails. I followed the instructions to log Outlook to find the reason. I found in the OPML log:

2020.08.24 20:48:54 SMTP (smtp.virginmedia.com): <rx> 525 5.7.13 Authentication Denied (VM305)
2020.08.24 20:48:54 SMTP (smtp.virginmedia.com): Retrying authorization
2020.08.24 20:48:56 SMTP (smtp.virginmedia.com): Disconnected from host
2020.08.24 20:48:56 SMTP (smtp.virginmedia.com): End execution

I am getting this error on two pcs, My wife has her own machine and email account on my Virgin account.

Any help would be appreciated.

David.

[Gareth_L]

Hello Davidlawuk

Sorry to hear you are having issues with your emails

Like previously advised, have you been able to run a full scan on your devices to see if any of the are infected?

Gareth_L

[Sololobo]

If you do know of an AV/Malware scanner which is capable of detecting spambots on multiple IoT connected devices please share it with the community.

Without such an AV/Malware scanner the only method I am aware of is that noted and linked to in post #2 in this thread - unless you know differently?

[Davidlawuk]

Hi Gareth. Thanks for your post. I think I may have confused some members by adding solved to my last post. Since my problem was sending emails, requesting Spamhaus to unblock me 'solved' the immediate problem, I can send emails but realise that this will only be temporary if the cause is not found.

I have run Wiresharp overnight (with no other device connected, with the settings as shown in the link above. My two pcs are connected by Ethernet although I do have other devices which use wifi.

The Wireshark report shows apparent access on port 25. (About 40 overnight).

Is this what I'm looking for and if so how do I correct it? I have Malwarebytes   Premium running and all scans are clear.

Your assistance is appreciated.

[用心棒 · Accepted solution]

This shows the network traffic captured from the telnet command used to confirm Wireshark is setup correctly. Do you see any traffic to/from IP Addresses other than 62.254.26.220 or starting with 192.168; no, then the device being tested is likely not the source of the spambot activity.

I'm a Very Insightful Person, I'm here to share knowledge, I don't work for Virgin Media. Learn more
Have I helped? Click Mark as Helpful Answer or use Kudos to say thanks

[ravenstar68 · Accepted solution]

Please shutdown the telnet command before stopping and restarting Wireshark.

Tim

[Davidlawuk]

Thanks, I missed the instruction to restart Wireshark:-( I'll redo.

[Davidlawuk]

Thanks to those who have helped with suggestions/advice. I tested my PC with Wireshark over 12 hours with no reports. Then did a similar test with connected devices. Still nothing.  I had asked Spamhaus to unblock my I.P. address, which they did. 

No problems since then.

David.

[ravenstar68 · Accepted solution]

If the problem returns make a note of which device you are using that you haven't used for a while.

[tubehound]

Spoiler

What's going on when this only happens on a VM public WiFi access point?

[Gareth_L]

Hello tubehound

Good question you have asked 

Can I please ask if you have more details please 

Location if possible

Gareth_L