Deutsche Telekom says I’ve been sending Spam on port 25

[paul.deitch]

Got two emails from DT to say one of my computers is sending Spam and infected with the Trojan “bamital”.

Well the house was empty on those days quoted last week as I was visiting WW1 and 2 monuments in Belgium and France. Just in case I checked the Windows power logs for those days and they are empty. I also ran a couple of virus checkers and they came back negative.

The only other computer running 24/7 is a Raspberry-Domoticz home monitoring system and SSH is switched off (never been on) and the password is not default. The system does send me a daily “I’m still here” email on port 25.

As I understand it WPA2 is “almost impossible” to crack. Yes in the past a couple of neighbours have used my WiFi but???

Unfortunately I have a crappy router from DT which has no meaningful logs and only logs about 3 days mostly complaining that the IP6 is not connecting...

What else can I check?

[Captain_Morgan]

Only thing I can suggest is contact them advise of the checks you’ve done and ask for the associated MAC address and see if you can match it to any devices on your nw

[grumbledoak]

Are you sure the emails are legit?

Bamital looks to be a search engine hijacker for click fraud
https://www.microsoft.com/en-us/wdsi/threats/malwa...
https://docs.broadcom.com/doc/trojan-bamital-13-en

I doubt that will run on your Raspberry.

[quinny100]

Are DT your ISP?

[deckster]

As above, are you absolutely certain the emails are genuine? What have they asked you to do?

According to Google the bamital botnet was taken down in 2013 and wasn't involved in sending spam anyway.

[paul.deitch]

@Captain_Morgan
Yes I did call them but they don't store MAC addresses.
@grumbledoak
they also sent me an official letter confirming this.
@quinny100
Yes they are.

So I'm out of ideas. Think I'll just send them an email tomorrow with all my "evidence" and see what happens.
The only other thing is to change the WiFi password
AND get a more professional router that stores a lot of data.

Any suggestions about a router? Do I need to go pro?

[dapprman]

Who is your ISP and do you know how often they change your external IP address. It could be that the address assigned to you when DT did a check was actually used by some one else (which was causing the spamming) during the actual attacks. BT are particularly bad for this - I used to get very frustrated with emails randomly bouncing because my IP address was associated with spammers (from before I got it) - oddly enough it was emails to {recpient}@btinternet.com that would block emails from me.

[eliot]

are any other ports on the Pi natted and open to the internet?

[anonymous-user]

paul.deitch said:

...
The only other thing is to change the WiFi password
...

As you've allowed neighbours to use your wifi you should definitely do this immediately; their PCs may well still connect to your wifi if they are nearer your router than their own. You've already scanned for viruses but be sure to be using one that is good and checks for malware too etc.

Are you sure you don't have any old laptops etc set up for other things like games, or connected to a music system etc?

Finally block port 25 outbound on your router. As far as I am aware port 25 is for server to server email transfer not for client to server (bit rusty on ports though nowadays). I think you said they were complaining about spam from port 25?

[e-honda]

I am assuming DT is your isp and not some random 3rd party, if they are not then just ignore them.

Chances are someone has sold them an AI threat detection system / false positive machine which thinks your daily emails look a bit like something associated with this malware.
Chances are they also have some vaguely worded bullst in thier t&cs which they feel means they can cut you off and you'll never be able to convince them its a false positive, so i'd suggest turning of these daily mails or changing the content and the hope they think it is now resolved.

[paul.deitch]

@eliot no, no ports open that I can see
@MikeStroud no, no other systems live. I've used Malwarebytes as well to check. The reason I use port 25 is the email service on my public website/server/domain which sends monitor info and snapshots from the cameras when they are motion activated. I double checked all those email accounts as well and there is no evidence of any tampering.

So it's over to DT now.
Thanks for all the feedback.