Re: virus/worms killing a network...

[Gene Delitzoy <delitzoy telus net>]

On Sat, 2004-07-31 at 12:55, Pedro Fernandes Macedo wrote:
> Cristiano Soares wrote:
> 
> > Hi All. Im desperate to get my network back working fine. Here is my 
> > situation.
> >
> > I have a FC2 server that has two NICs. The first one is connect to my 
> > ADSL router, and the other one is connected to a network that receive 
> > IPs from that server through DHCPD service, and then the FC2 do the 
> > firewall/masquerade. All the 30 machines can browse nice until 2 or 
> > maybe more machines that has virus/worms get online. Ive seeing that 
> > W32.MsBlast is the cause of most of these link down problems, but now, 
> > it looks to be more than just w32.msblast. My queston is: IS THAT 
> > POSSIBLE TO INSTALL A SOFTWARE OR SOMETHING LIKE THAT IN THE FC2 
> > SERVER TO PREVENT OR AT LEAST TO DETECT (by IP number) THE MACHINES 
> > THAT HAS THE VIRUS, SO IT DOENST KILL MY CONNECTION. Thanks in advance.
> >
> >  
> >

There are tools to check vulnerable machines, hfnetchck, you can also
use tools from symantec to scan for already infected machines. Mcafee
and symantec have  one, as well as microsoft.