Menu
Reply
GrahamH4
  • 1
  • 0
  • 0
Joining in
777 Views
Message 1 of 14
Flag for a moderator

I can receive emails but cannot send them

I keep getting error messages when trying to send emails using mail for windows 10, outlook and google. I have been to the spamhouse website and entered my IP address to have it removed but this still does not fix the issue. The emails just sit in the outbox. The port is 465 and the security type is SSL/TLS. The error message i get is   -  Cant connect to server. ([ 525 # 5.7.13 Authentication Denied (VM305) ]).

The above error message is shown when using Google.

Can anyone help?

 

0 Kudos
Reply
boothy99
  • 301
  • 11
  • 163
Fibre optic
729 Views
Message 2 of 14
Flag for a moderator

Re: I can receive emails but cannot send them

Hi GrahamH4,

Have a look through ravenstar68's post, below. The error code you're getting, suggests you have a spambot on your system sending out spam emails. Removing yourself from the blocklist on Spamhaus (as you've found out) quickly gets reverted when the spambot sends out again. Once you've located and removed the 'bot, you'll be automatically removed within ~ 24hrs.

I had a similar issue which was fixed with his guidance. Here's the link you'll need to have a read through  -

https://community.virginmedia.com/t5/Security-matters/Searching-for-Spambots-on-your-network/td-p/40...

0 Kudos
Reply
boothy99
  • 301
  • 11
  • 163
Fibre optic
711 Views
Message 3 of 14
Flag for a moderator

Re: I can receive emails but cannot send them

My fixed issue if you're interested to see what went on, is here. 

https://community.virginmedia.com/t5/Forum-Archive/Re-Message-Delivery-Failure/td-p/4089017

For me, we discovered the spambot was on my Amazon Fire TV Stick, but ravenstar68 reports they can be embedded in PC's, laptops, mobile phones, smart TV's, etc ... so although his help page appears in-depth, it's worth working through slowly to get to the bottom of it and find the culprit (and stop spam being sent out from your home).

Good luck 👍

garyarnott
  • 72
  • 0
  • 8
Dialled in
693 Views
Message 4 of 14
Flag for a moderator

Re: I can receive emails but cannot send them

Boothy can I please ask for your help please!

How can I tell in Wireshark which device is acting as the spambot?

I've had it running for a few hours scanning for port 25 but how do I tell which I.P. address has the issue? Is one of the results from the capture suppossed to come back all highlighted in red or something that makes it standout?

I followed the tutorial on https://community.virginmedia.com/t5/Security-matters/Searching-for-Spambots-on-your-network/td-p/40... but still can't see which result I'm looking for which tells me that I've found the device responsible!

Any adviced most appreciated!

Cheers

Gary

0 Kudos
Reply
boothy99
  • 301
  • 11
  • 163
Fibre optic
678 Views
Message 5 of 14
Flag for a moderator

Re: I can receive emails but cannot send them

Hi Gary,

It's been some time since I ran through the process, so I'm hoping ravenstar68 will jump in (I've PM'd him on your behalf).

I made the mistake of rushing through his instructions and managed to miss a step 🤨 I'm not suggesting the same might have happened to you, but ask you to go through the steps a bit at a time. I found everything was actually there when I revisited them, and spotted my obvious mistake.... eventually.

Really sorry I'm not being very helpful but hope ravenstar68 will help you out.

garyarnott
  • 72
  • 0
  • 8
Dialled in
667 Views
Message 6 of 14
Flag for a moderator

Re: I can receive emails but cannot send them

Thanks so much for your time and help, greatly appreciated 🙂

All I've done today is try to sort this problem out and probably like so many other people I was only aware of it when I couldn't get my emails from my Outlook client and discovered this Spamhaus website that flagged my IP address up on all 3 lists!!

I've still got Wireshark running in the background on my PC but I don't understand what I'm looking for as nothing obvious is being highlighted. I'm assuming I have to run this utility on every PC in the house that's on the network?

In the meantime I've added port 25 to my both my Windows firewall and my routers blocked outgoing ports and just removed all the apps off my Nvidia Shield in the hope it might help!

All my devices are connected via network cables so I'm hoping that makes it easier to track down what the problem device is!

Really hoping ravenstar68 can help shed some light on this for me and point me in the right direction, fingers crossed!

Thanks again 🙂

Gary

ravenstar68
  • 19.37K
  • 1.14K
  • 8.44K
Very Insightful Person
Very Insightful Person
662 Views
Message 7 of 14
Flag for a moderator

Re: I can receive emails but cannot send them

@garyarnott 

The two lists you should be concerned with are the XBL and SBL (or CSS) lists.

All VM residential customers SHOULD be on Spamhaus PBL and SORBS DUHL - these lists identify IP addresses that shouldn't be hosting mail servers.

You only need Wireshark installed on one PC - and that should be a Windows 10 PC with a wireless adapter.

If you read my post - https://community.virginmedia.com/t5/Security-matters/Searching-for-Spambots-on-your-network/td-p/40...

The check can be boiled down to two stages.

1.  Installing Wireshark and making sure that the PC that wireshark is on is not the source of your issues.

2. Turning on the wifi hotspot on the PC with Wireshark on - monitoring the hotspot interface and then connecting all your wireless devices to the hotspot instead of the router.

Once you've identified the offender and cleaned it THEN you can turn off the hotspot.

Blocking Port 25 outbound is a BAD idea as you mask the issue without dealing with the cause.

Tim

I'm a Very Insightful Person, I'm here to share knowledge, I don't work for Virgin Media. Learn more

Have I helped? Click Mark as Helpful Answer or use Kudos to say thanks

garyarnott
  • 72
  • 0
  • 8
Dialled in
656 Views
Message 8 of 14
Flag for a moderator

Re: I can receive emails but cannot send them

Thanks for the reply Tim.

I have 3 Windows 10 PC's that are connected to the internet via network cables to my ASUS RT-AX86U router and none of my PC's have wireless adapters for Wi-Fi access.

I have an Nvidia Shield that is also connected via a network cable and I have just removed all the apps off it as a safety precaution.

I'm struggling to know how to proceed, do I need to run Wireshark on all the 3 PC's and just leave it going to see if anything shows up? I'm unsure of what I'm looking for and to what is classed as an alert being found etc!

Any help would be greatly appreciated 🙂

 

0 Kudos
Reply
boothy99
  • 301
  • 11
  • 163
Fibre optic
590 Views
Message 9 of 14
Flag for a moderator

Re: I can receive emails but cannot send them

Hi Gary,

If none of your PC's are WiFi enabled, and everything else is on wired Ethernet .... then have a read again of Tim's directions, ..particularly around point 10 ......

"

  1. The address we are interested in is the local address - in this case 192.168.137.213 this is where the traffic is being sent from.  So this is the device we would need to investigate/reset 

Note that the above can be adapted for Ethernet devices.  In such circumstances we could connect the PC to the internet via Wifi and then bridge the ethernet and wifi connections:

https://www.windowscentral.com/how-set-and-manage-network-bridge-connection-windows-10

We would then connect any ethernet only devices to the PC and it would actually get a DHCP address from your router and connect to the internet via the bridge.  This would enable us to sniff the ethernet connection to look for signs of spam activity.  Please read the warning about the device running the bridge losing internet connectivity and how to fix this."

Now .... speaking from ignorance (hopefully Tim will come in here) .... I believe that in order for the single PC with Wireshark on it ... that that PC needs to connect wirelessly to your router - via a purchased /loaned WiFi dongle (adapter). Everything else then connects to that PC via cable in order for packets to be found that're using port 25 (the culprit).

Before you rush out n' order a WiFi dongle .... await Tim's advice / & corrections of any incorrect assumptions I've made. Also have a read through the Windows 10 Bridge instructions, from his link, above.

Also .... just checking .... is your filter for watching port 25 set up correctly and showing up towards the top of the Wireshark interface?

0 Kudos
Reply
ravenstar68
  • 19.37K
  • 1.14K
  • 8.44K
Very Insightful Person
Very Insightful Person
472 Views
Message 10 of 14
Flag for a moderator

Re: I can receive emails but cannot send them

I'm not as active on the forum due to personal circumstances, and to be honest I really wanted to take my time to respond.

@garyarnott I created my post because people were struggling to find the reason they were listed on the CSS, with some going so far as to assume that the listings were false positives.

When creating the post one of the main criteria was that there should be minimal outlay, HOWEVER, in situations such as yours you may need to spend a little money either on a wireless dongle or a usb ethernet port.

One of the first things you need to get out of thinking is that this is just a PC thing, nor is it necessarily a irus in the traditional sense, rather it is a program acting as a network proxy allowing people to pass traffic via a device on your network.

My technique essentially uses one PC to sniff the traffic passing through it and then turning that PC into a second NAT router on your network in order to check as many devices as possible in one go.

The system is adaptable to just ethernet devices BUT you would need AT LEAST an additional ethernet adapter (hence the suggestion of the USB ethernet dongle, but that would only allow you to check one device at a time.  To check several devices at once, you'd need a switch as well.

This however ignores wireless connected devices such as smartphones and tablets

Tim

I'm a Very Insightful Person, I'm here to share knowledge, I don't work for Virgin Media. Learn more

Have I helped? Click Mark as Helpful Answer or use Kudos to say thanks