Community discussions

MikroTik App
 
amigo3900
just joined
Topic Author
Posts: 16
Joined: Fri Oct 15, 2010 10:46 am
Location: Richards Bay South Africa
Contact:

Cutwail Spambot

Wed Dec 31, 2014 8:42 am

To whoever might be able to help...

I am running a wireless network, and make use of a third party for my emails. Thus port 25 is blocked.
My public IP keeps on getting blocked due to a spammer somewhere on my network, which is behind my firewall and NATTED.

The following possibility is what is causing the problem:

"It has come to our attention that a pc (or more) is infected with the “Cutwail Spambot”

Cutwail is a complex infection and requires a number of steps to ensure that it's eradicated.

First, cutwail spams out very high volumes, is one of the largest vectors of malware on the Internet, and almost every cutwail infection also has a copy of the pushdo (DDOS by web transaction) malware and the Zeus botnet. The Zeus botnet controls the cutwail/pushdo pair as well as does information stealing/keyboard logging. Hence, this is a very severe threat - not just to the owner of the infected computer, the other members of your internal network (if you have one) but the rest of the Internet too."

Any idea of how to"catch" this pc on my network, perhaps on my firewall somehow? :? :?

ANY HELP IS APPRECIATED.

Thank you in advance.

Hennie :D
 
KillerOPS
Member Candidate
Member Candidate
Posts: 150
Joined: Sat Oct 31, 2009 9:27 pm

Re: Cutwail Spambot

Wed Dec 31, 2014 11:33 am

for start, have a look for traffic on port 25 TCP. You can use torch for that. Once you find the pc-s trying to send spam, you can move on and investigate them deeper.
 
bingo220
Member Candidate
Member Candidate
Posts: 124
Joined: Sun Sep 22, 2013 9:30 pm
Location: Ukraine

Re: Cutwail Spambot

Wed Dec 31, 2014 2:26 pm

/ip firewall filter

add chain=forward prot=tcp dst-port=25 src-address-list=spammer act=drop comment="Block port-25 for SPAMMERS from spammer-list"

add chain=forward prot=tcp dst-port=25 connection-limit=30,32 limit=50,5 src-address-list=!spammer action=add-src-to-address-list address-list=spammer address-list-timeout=30d comment="Add SPAMMERS to spammer-list for 30 days"

Who is online

Users browsing this forum: jaclaz, pturmel and 126 guests