Hello , i was searching for script for my liitle idea but i am not soo mutch inside the mikrotik things
Can somebody provide a script who Detect the infected users and automaticly drop them or redirect them to a page telling them they have a virus infection and they need a good looking antivirus protection. It will decide allot of problems in allot of networks

Tnaks in advice , and sorry for the bad looking English

Nice idea, however, the biggest problem is in the detecting the infected client. The only way i know so far is that some trojans/viruses sends huge amount of emails (probalby used as the spam relay) which can be detected. For the other ways i dunno how to be sure. Common trojan ports can be changed easily on the server/client so detection won't work (becouse is different port).

It will be good also to get just the usual ports , you cant clean your network on 100% but when the network is large it's nice to try to prevent some of the viruses not all ..

I found that all my users who are broadcasting on port 445 135-139 1433-1434 10000 heve a viruses there is no one without virus, thats why i created a rule to put them in address-list

/ ip firewall filter
add chain=forward action=accept dst-port=80 protocol=tcp src-address-list=VIRUSES comment="Accept port 80 in VIRUSESS list" disabled=no
add chain=forward action=add-src-to-address-list in-interface=ether1 dst-port=10000 protocol=tcp limit=50,5 address-list=VIRUSES address-list-timeout=5m comment="" disabled=no
add chain=forward action=add-src-to-address-list in-interface=ether1 dst-port=1433-1434 protocol=tcp limit=50,5 address-list=VIRUSES address-list-timeout=5m comment="" disabled=no
add chain=forward action=add-src-to-address-list in-interface=ether1 dst-port=135-139 protocol=tcp limit=50,5 address-list=VIRUSES address-list-timeout=5m comment="" disabled=no
add chain=forward action=add-src-to-address-list in-interface=ether1 dst-port=445 protocol=tcp limit=50,5 address-list=VIRUSES address-list-timeout=5m comment="" disabled=no
add chain=forward action=drop src-address-list=VIRUSES comment="Drop for VIRUSES-list" disabled=no

After that i created a rule in the nat table where it sends all connections to port 80 from the infected users to web page where it sayng VIRUS is detected pls fix your pc with theese tools ....

/ ip firewall nat
add chain=dstnat action=dst-nat to-addresses=10.10.10.10 to-ports=80 dst-port=80 protocol=tcp src-address-list=VIRUSES comment="" disabled=no

I hope it will help to somebody I hope it will help to me also
If somebody heve other idea or to make it better pls let us now, tnks !

Does it work? would you like to shear your result?

Thanks