Spam from mikrotikOS, help!

RouterOS General
1

Hi to all!

I discovered that my ip is getting black listed on several email black list.

I have created a firewall log to see whats going on on port 25 and, there is a lot of outgoing traffic directly from my ip to this port.
There isn’t any device connected to the router right now. Few weeks before we discovered we had someone that uploaded mikrotik.php and created scheduled and scripts. I updated mikrotik OS and deleted it, but week after we are having this spam problems..

Hope someone can help me, thank you in advance.

2

Step 4 in https://blog.mikrotik.com/security/winbox-vulnerability.html is relevant here.

  1. Use “Export” command to see all your configuration and inspect for any abnormalities, such as unknown SOCKS proxy settings and scripts.

If you have problems reading your configuration, you can post the result of /export hide-sensitive here for review.