Page 1 of 1

my clients is virused, help me plees

Posted: Wed Oct 10, 2007 10:31 pm
by norocel
Helo ,
I have mikrotik ros 2.9.27, and 400 windows-xp clients.
A lot of clients are virused and make flood to dns provider servers (udp port 53).
How can i make a filter for this virused clients?

10x in advanced

Re: my clients is virused, help me plees

Posted: Thu Oct 11, 2007 12:01 am
by gmsmstr
either block the entire DNS port, or add a rule to add SRC-ADDRESS to any IP that has too many DNS requests.

Re: my clients is virused, help me plees

Posted: Thu Oct 11, 2007 12:09 am
by norocel
either block the entire DNS port, or add a rule to add SRC-ADDRESS to any IP that has too many DNS requests.
u can be more specific, pleez?

Re: my clients is virused, help me plees

Posted: Thu Oct 11, 2007 12:32 am
by GuJack20
400 PC virused?? U got a nasty neigborhood :(:(:(
My solution would be to desinfect the clients!!

Re: my clients is virused, help me plees

Posted: Thu Oct 11, 2007 2:10 am
by Chupaka
m.b. New Firewall Rule -> Extra -> Limit

Re: my clients is virused, help me plees

Posted: Thu Oct 11, 2007 1:19 pm
by normis
unplug their cable, and if they call to complain - suggest to remove the virus and then internet will be back. i've seen this and it actually works

Re: my clients is virused, help me plees

Posted: Thu Oct 11, 2007 1:28 pm
by GuJack20
:wink: :D :wink:

Re: my clients is virused, help me plees

Posted: Mon Oct 15, 2007 10:38 am
by jorj
Esti din RO ? Daca da, lasa un ym, si te pot ajuta.

You can block the ip of each client suspected of a virus, and they will call you. Just use torch to find out what's happening, and then add a firewall rule with "drop" on a "virused" src-address list. Wich you make by adding the infected ip's to it.

Re: my clients is virused, help me plees

Posted: Mon Oct 15, 2007 1:18 pm
by norocel
Esti din RO ? Daca da, lasa un ym, si te pot ajuta.

You can block the ip of each client suspected of a virus, and they will call you. Just use torch to find out what's happening, and then add a firewall rule with "drop" on a "virused" src-address list. Wich you make by adding the infected ip's to it.

Salut, sunt din ro
Am rezolvat ceva ceva dar nu e foarte bine.
ym: cccblue_suport@yahoo.com

Poate ne sincronizam pe messenger intr-o seara

Multumesc,

Re: my clients is virused, help me plees

Posted: Tue Oct 16, 2007 1:05 pm
by jorj
k.
You're on my list.