5

My brother gets malware infections practically every week. Apparently he had a infection over the past 24 hours, I only noticed it because I checked the router logs and saw a massive amount of network traffic on his MAC address.

How can I limit the damage on the network when this happens? I try to educate him but nothing ever sticks. I even set up auto updates, EMET, antivirus, OpenDNS familyshield and a few other things but he always manages to get infected. I usually just MAC block him or egress the bandwidth to 1kbps when I see a ton of traffic until I can physically check the computer.

Improve this question
3
  • 1
    You answered your own question already: Block access in the router based on his computer's MAC address(es). Perhaps you mean another type of isolation (which?)? – Steven Volckaert May 1 '14 at 6:35
  • 2
    To prevent other computers from getting infected i would suggest putting him in a DMZ – BadSkillz May 1 '14 at 8:20
  • As BadSkilz suggests isolate him with a router between the rest of your internal network and him. – zedman9991 May 1 '14 at 13:03
3

If your router has the features you could create a separate vlan and isolate his computer in that using firewall rules. Other than that MAC address filtering is really the only way.

However what I would do is ban him from your network. He won't learn his lesson because he has you providing free tech support whenever he makes a mess. Kick him off for a week, then limit his access to some very basic sites for another week or so. Charge him for tech support. He'll get the message or take his activities elsewhere.

Improve this answer
1
  • 1
    +1 He won't learn if he experiences no failure. If you keep fixing it, he'll keep breaking it... – schroeder♦ May 1 '14 at 15:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.