How to stop (smtp) viruses !!

Diambil dari http://forum.mikrotik.com/viewtopic.php?t=11474

Hi, i created these 2 simple rules for firewall forward and this work very fine…… do not say it to anybody ;) :D

2 ;;; BLOCK SPAMMERS OR INFECTED USERS
chain=forward protocol=tcp dst-port=25 \
src-address-list=spammer action=drop

3 ;;; Detect and add-list SMTP virus or spammers
chain=forward protocol=tcp dst-port=25 connection-limit=30,32 \
limit=50,5 src-address-list=!spammer action=add-src-to-address-list \
address-list=spammer address-list-timeout=1d

When detect an infected user with a worm or doing spamming this rule add this user to a spammer list and block the SMTP outgoing for 1 day ;)

Regards!
Alessio