Customer PC all infected after 3week

[certifiedtek123]

Hello,

Sounds like customers RE infected with antivirus 2008 2009, I did do a clean install an install Kaspersky three weeks ago he had a lot of stuff going on to back then.
Well he’s all Mad he says the Kaspersky he bought from me didn’t protect in and he wants to throw it in the trash, and says he shouldn’t have gotten infected, wants it all fixed up for free now.
My question is what other techs who own business fix for free?
Going to need to lock it down even more Im suprized Kaspersky didn’t block, I haven’t looked at their PC at so, he says it’s just a mess like it was before pop up and slow when all at.

I wonder what Bryce would do in this situation?

Would appreciate any advice…
Thanks

 

[georgenoise]

Don't fix it for free. I make sure to tell all my clients that no antivirus/spyware programs are 100% at blocking and preventing. I make sure to remind them that they need to practice safe internet surfing. I've had people bring me a PC on Monday, pick it up Tuesday, and bring it back on Wednesday for the same problem. They know what they did and they know they have to pay for it.
If you fix it for free you will open yourself up to doing free work more often than you like. In my professional opinion, if you explain to him that you can't be responsible for something he could have caused at the click of a button and he still insists that you fix it for free, I think it might be time to let him wander down the road to the next shop. Customers like that you really don't want, once you do that for him he will continue to try to haggle and talk his way into anything free or discounted that he can. Don't get me wrong though, I do have my big dollar customers that I take care of in a situation like that but you have to use discretion. If the customer spends thousands a year with you it would be worth it to repair it(at a discounted rate) to keep his business. If it's a one time wander off the street, I wouldn't worry to much.

--George

 

[nonchalant]

Had the same thing happen to me a couple of months ago.

I advised the customer (as I did when I returned the PC to him the first time) that NO antivirus provides 100% protection against viruses & particularly this one which is often morphed by the writers.

As it turned out I was able to enable a few features on the antivirus which were turned off by fault (to reduce the use of resources) & scan his PC and remove it w/o a format. So at the end of the day I was able to charge him a reduced fee compared to my 'full format' fee.

I also beefed up the security on his PC by adding a firewall & additional anti-spyware apps.

 

[Simmy]

Lets imagine he has a petrol car and he accidentally puts in diesel. He has to call out the AA to empty the tank. The AA man puts an "unleaded petrol only" sticker on the car so he doesn't make the same retarded mistake again If he accidentally puts diesel in again a week later, would he expect the same AA man to come out for free? I don't think so.

Refuse to fix it for free. Tell him you're not responsible for what he downloads on his machine. I really hate irrational customers like this

 

[NWPhotog]

Hello,

Sounds like customers RE infected with antivirus 2008 2009, I did do a clean install an install Kaspersky three weeks ago he had a lot of stuff going on to back then.
Well he’s all Mad he says the Kaspersky he bought from me didn’t protect in and he wants to throw it in the trash, and says he shouldn’t have gotten infected, wants it all fixed up for free now.
My question is what other techs who own business fix for free?
Going to need to lock it down even more Im suprized Kaspersky didn’t block, I haven’t looked at their PC at so, he says it’s just a mess like it was before pop up and slow when all at.

I wonder what Bryce would do in this situation?

Would appreciate any advice…
Thanks

Did you transfer the infection from the original machine by transferring his data over? That would be my guess and a perfect example for Wheelie of a virus hiding.

 

[Bryce W]

This sounds like your typical client that believes that technology will fix everything for them. While I do see it from his perspective if I was in his mindset, I would charge him like the others have mentioned. Of course, you need to take into account whether this guy is a good client. If he has given you thousands of dollars in work, you might want to consider doing it for free even if it was his fault. No point being right but losing thousands of dollars.

Id go out there, charge him (slightly discounted if you dont feel right, but remember this may look like a "admission of guilt" to him). Most importantly, educate him and explain that the antivirus wont protect him 100%. I usually say something along the lines of:

"antivirus software scans your computer for viruses, it does its best to remove whats already on there and can help you from getting some common ones via email etc.. However, it doesnt want to interfere with your actions so if you ALLOW something "in" you will still get infected. Many clients get fooled by 'free' screensavers, toolbars, special viewers or fake error messages saying that you have thousands of viruses and you need to download something in order to remove them. Watch out for these things otherwise this sort of thing will keep on happening"

Something important here is to make him think back to how he could have gotten infected, ask him the following questions:
Did you recently install any free screensavers, toolbars, smilieys etc..?
Did you have to download some files before you can view certain content? (nice way of saying porn installers)
Did you get an error message saying you have errors on your computer and that you need to fix them now?

If he matches this up to something he did, he knows in his mind that it was probably his fault.

If he still gives you a hard time, I recommend you (nicely) use the petrol example Simmy said.

Did you transfer the infection from the original machine by transferring his data over? That would be my guess and a perfect example for Wheelie of a virus hiding.

I dont think Antivirus 2008/2008 spreads that way like a traditional self replicating/spreading virus. I think it needs an installer to sink its hooks into a system; typically by fooling the victim thinking they are installing a legitimate program.

 

[The Birddog]

Back to the same old problem, never give freebies. You fixed it and it worked, now it dosn't. Tough sh** Batman, you need to pay again.

 

[NWPhotog]

I think assuming it was the Client's fault with out knowing is a huge mistake. It is at least as likely the machine was not 100% clean to begin with.

 

[nonchalant]

I think assuming it was the Client's fault with out knowing is a huge mistake. It is at least as likely the machine was not 100% clean to begin with.

Chances are this infection was a 'fly by'. IE the PC was infected simply by visiting a porn site. Even if it was the result of a visit to say a regular well-known web site - its not the repairers fault it was reinfected (I am assuming the PC was clean or formatted the first time).

Ive seen this infection blocked simply by visiting regular SEO sites.

I also have a customer who rings me at least 3-4 times a year to clean up an infection on his PC. By his own admission he regularly visits porn sites (which his wife knows nothing about & is often the one that rings me lol)

 

[Jory]

For the most part proactive anti-virus and anti-spyware programs are snake oil. If that wasn't he case none of us would have a job, or at least be poorer than we are now. It hasn't always been like that, and for some types of threats it still isn't, but these new threats play by a different set of rules.

It takes very little time for these spyware guys to make a new variant of the same piece of code that's completely undetectable by the current signatures. It's just simply impossible to catch the stuff before you're infected because by the time the signatures are updated those variants are already dead, and more have sprung up in their place. The only real prevention is being a smart user. No anti-virus or spyware program will ever be able to keep up, and anyone that thinks they're doing anything except protecting you from yesterday's threats is kidding themselves.

My advice would be to fish some information out of him like when it started happening, what he was doing while it happened, etc. Then tell him you're willing to see how he got the malware, but if it was his fault you're going to have to charge him. I'd bet a dime to a dollar you can take that info you got from him and look through his temp files, cookies, index.dat file, limewire shared folder, etc and find how he got infected. Most likely doing something he shouldn't have been doing in the first place. Once you tell him what you're planning he'll probably just break down and admit he clicked on some pop-up on a porn site and immediately knew he got infected. I've had similar stuff happen.

The only way you should be doing anything for free is if you felt like you misrepresented the abilities of the software you sold him to stop future infections. The reason I don't bother trying to sell anti-virus software is because you make very little and you get potential problems like this one.

 

[l337]

i agree 100% with jory to clean it but track it down and advice him of cost due to his own fault causing it. and always when selling or even recomending i make sure to empahasise that no antivirus is indeed 100% effective.

cheers

 

[bagellad]

Explain the terms and have him sign something agreeing to it. Its not your fault he keeps getting the virus unless you left a short cut on the desk top saying "click here for a special prize!"

 

[lawson_jl]

I have only fixed a PC for free once. I cleaned a PC of virus and spyware. I was sure it was clean I tested it myself that night no pop ups, etc. The client picked it up, used it two days later and said they were infected with a virus again. I told them that I would do a clean install and install an antivirus this one time. I did the work, 40 minutes later I called the client and said I 100% sure the PC is completely clean and if they get a virus after this it's their fault and I won't be fixing it for free.

 

[technut]

I agree with bagellad. I always get clients to sign on the invoice, which explains that they are happy with the work I have done and any further problems will be subject to my standard rates. That way I have a leg to stand on if they come back a week later complaining that there computer is infected.

Stand your ground and don't do it for free. I hope all goes well.

technut

 

[nonchalant]

NOD32 uses something called ThreatSense which is a patented technology, where the threat detection no longer relies only on signature databases, but instead uses advanced heuristics.

TrustPort Antivirus also uses heuristics - in fact it has 1st,2nd,& 3rd level heuristics which can be enabled to varying levels within its multiple antivirus engines. Many antiviruses today (but not all) use this technology.

It also uses 'Sandbox' - "SandBox inserts any suspicious file into a simulated computer environment, complete with emulated network connections, where it monitors the actions of the file in real-time, enabling it to behave as if it were in a live environment. If virus behavior is detected and confirmed, the antivirus will prevent the virus from spreading and causing harm to your system".

 

[RoboGeek]

With so many rootkits and other garbage, you can just treat an infection as a forensics case.

Real world case:

I sold a new PC to a person who was going to use it only for her medical transcription biz. 2 days later she calls saying the screen is strange and she can't log on to her sites for data.

Fired it up and sure enough there sits a downloader and a few other trojans. And in the history is myspace and aim.

So I ran a forensics analysis on the infections backwards, and found exactly when the malware was installed. I fixed it for free, but proved her kids had crashed the PC


And just a comment on previous posts - any AV/AS/malware suites lag behind the real world by 30-120 days with new definitions. Most cleaning tools are at least 30 days behind. Your customers have to understand they can and will be reinfected - at least if they run windows! Perfect chance to get them on linux!!!