This does not always work the virus once on their system is a bitch to get off unless they use the worm removal tools by Symantec and in some cases I have had to wipe their drives clean and start from scratch..
----- Original Message ----- From: <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Wednesday, November 26, 2003 7:52 AM Subject: RE: [smartBridges] Virus attacks In this situation, I log into their radio and type in an invalid ESSID, kicking them off the AP. They're no longer on the network. They then get a phone call from me and I explain why they've suddenly lost connection. They get the option to pay me to come out and fix their computer or promise that as soon as I get them back online, they will download and install AV software (www.grisoft.com is *free*, so they have no excuse). If they agree, I have them reset their radio which gets them back online. If they keep doing it, I kick them offline and they get a tech-support charge from me to go out there and fix them (haven't done this yet, but i've got a couple people who are starting to get on my nerves. Maybe it's an education issue, maybe it's apathy --in either case, I DO NOT need that kind of crap on my network!) If I get more than 2 or 3 people doing that in a week, I send out an email to all customers emphasizing the importance of keeping their AV definitions current, and Windows Update is their friend. TIM +++++++++++++++++++++++++++++++++++ Hi, We are running a wireless network servicing about 30 customers on 4 Airpoint AP's. Currently a subscriber gateway is being used to authenticate users. We have had an ongoing problem with users getting viruses and then bringing the network to a crawl and/or completely down as the virus scans and/or spams to spread itself. Removing the customer from the subscriber gateway stops any access to the Internet at large, but because they are still connected to the AP's, the AP itself and our internal equipment are still getting hammered. Currently we are not using the internal MAC filtering feature on the airpoints. Has anyone know if this (or any other actions) will allow us to completely shut off an infected user? Any input you have would be appreciated. Thanks, Andrew Goble Tim Foster www.AledoBroadBand.com Aledo's only high-speed ISP The PART-15.ORG smartBridges Discussion List To Join: mailto:[EMAIL PROTECTED] (in the body type subscribe smartBridges <yournickname> To Remove: mailto:[EMAIL PROTECTED] (in the body type unsubscribe smartBridges) Archives: http://archives.part-15.org The PART-15.ORG smartBridges Discussion List To Join: mailto:[EMAIL PROTECTED] (in the body type subscribe smartBridges <yournickname> To Remove: mailto:[EMAIL PROTECTED] (in the body type unsubscribe smartBridges) Archives: http://archives.part-15.org
