We created a set of RAS filters that we can call up in the user's RADIUS
record - Block ICMP request, Block SMTP outgoing, etc. When the user has a
virus we just set the filter. They can still get on without doing any
damage, yet still download fixes, etc. They might call if they need to use
SMTP instead of webmail.