To many dynamic rules created by infected machine

Eric W. Bates ericx at
Wed Sep 15 05:58:45 PDT 2004

Hash: SHA1

Pat Lashley wrote:
| --On Tuesday, September 14, 2004 20:59:43 -0400 "Eric W. Bates"
| <ericx_lists at> wrote:
|> It's a small store.  Folks with broken computers bring the
|> machines in because "It doesn't work". They usually don't
|> know what is wrong with any given machine; and they try to
|> be careful (remove the hard drive and attempt to clean it
|> first); but eventually there is a need to put the machine
|> on line and try to update Norton's virus list.
| Befoe bringing it on-line, why not mount the disk on a FreeBSD
| machine and run ClamAV over all the files?  It's not guaranteed
| to catch everything; but it should at least reduce the window.

They do something similar.  They mount it on a windows machine and run

The reality I'm trying to accommodate is that the staff will not always
be knowledgeable, and even if they follow procedure there will always be
a virus or spyware that gets thru.  Clearly this problem could have
easily been solved by simply unplugging the damaged machine from the wire.

| You could also consider setting it up so that the initial
| reconnection is on a separate cable going through a firewall
| that -only- allows the connections necessary to update the
| Norton virus list.  Once it is updated, unplug it from the
| network, run the virus check, and only then plug it into
| your main LAN.

That's a good idea.

| -Pat

- --
Eric W. Bates
ericx at
Version: GnuPG v1.2.2 (GNU/Linux)


More information about the freebsd-net mailing list