Ethics in Formatting?

[Trouble-Shooter]

I have been servicing computers for a long time. And as all types of malware become more complex, we find ourselves considering formatting a customer's hard drive much more often. Many of the computer repair shops local to my county seem to have formed a default policy of formatting a malware-ridden hard drive instead of cleaning it. While I understand that cleaning some of the worst malware is a great task that is time consuming, I also believe that formatting by default enables technicians to avoid continued self-education that has always proved invaluable and necessary to our part of the IT industry. Fortunately for the sake of job-security, many versions of malware easily circumvent anti-spyware scans which inevitably leads to our phones ringing. Personally, I make it a point to set myself apart from the other shops by knowing or learning how to remove the worst of the worst, thereby leaving my customer's partitions intact. After all, if all it takes is a program scan to fix every computer problem, we will find ourselves much less necessary to society and industry.

Now, I have a different pricing schedule for my services than the local shops. I charge by the job, and not by the hour. I am a mobile service, so my time spent "out and about" each day is very well planned and deliberate in every way. I spend a lot of time at home(which is my shop, essentially) working on customer's computers, so I do have the luxury of time to endlessly stare at "icon fields" such as the system32 folder.

I feel I can better serve my customer if I know how to remove these bugs and not just format by default. I recently fixed a computer that had 3 of the top-5 highest threats listed on AVG's home page, and I didn't format it. These included WinAntivirus, Zlob (multiple variants), and honestly I can't remember the other one at the moment.

I'm not saying a format should never be necessary, but I think it is an overused practice. Hearing the techs talk at the other local shops, it is borderline unethical the way they jump to that end so quickly. Maybe I'm just stubborn. What do you think?

 

[gunslinger]

I think you are stubborn, but at the same time you make good points. I think re-formatting is much overused these days. Actually overheard a guy at a local shop tell one of the workers there, that his fonts in Internet Explorer were too small for him to read. The guy that worked at the shop instantly suggested that he reformat the hard drive and reinstall Windows. A job that coincidently they charge around $225 for.

I think it's a fine balancing act. I figure how long will it take me to backup all the customers data and settings, format reinstall Windows, install updates, and then put the customers data back on the drive after full virus scan. If removing the offending programs is going to take more time than this would then I'll reformat. This saves my time and customers money.

 

[MHCG]

I just had one of these. I gave the customer an option. She chose the cheaper option (backing up data and reinstalling OS).

 

[Andyuk2007]

I only format as a last resort as i feel that you should try other options first before resorting to such a drastic measure its also kinda lazy to format if you cant clean a virus ridden computer e.t.c

 

[Simmy]

Cleaning a computer can take 1-2 hours and even after spending that much time on it, you can be left with an infected and unusable computer depending on what damage it has done to system files.

Doing a basic windows reinstall takes an hour (using unattended and updated installation discs) and backing up/restoring personal files takes another hour and you're guaranteed to have a clean machine by the end of it. It does depend on the customer's choice and what state I consider the machine to be in though.

With over a million virus' (virii?!) out there, it's impossible to know how to remove them all manually and even virus/spyware scanners can have difficulties. As gunslinger says, it's a balancing act.

I'm going to try my damnedest to manually clean the next virus infected computer I get, just to see how long it takes.

 

[MHCG]

I don't understand why this conversation is even happening. We're running businesses. You do what is best for your business. For my business, letting the customer choose what he/she wants to do is what's best. I don't give a damn if people look down on my technical skills or if you think it's lazy. I'm here to make my customers happy and make money.

I know that I can out troubleshoot any computer tech in my town, but that's irrelevant because if I spend 5 hours trying to clean a computer, I look like a jackass when I then have to charge more than half of what the computer costs to replace.

The idea that we should care about what other techs think is ridiculous. Do what is best for your business and ignore the rest.

 

[TimeCode]

I agree...

I completely agree with the balancing act statement. I tend to lean towards retaining data and removing viruses (Incorrect I know but I just don't care. How do you pronounce the correct word anyway?) over formatting. I'm currently working on my buddy's multi-infected PC that I'm really not even getting paid for. I'm trading the work for a brand new long-board deck though. He is just starting a company making decks!

 

[NYJimbo]

I find that if a infected computer can fully boot then it's usually repairable without a reformat. Like others have said it depends on how much time it will take and how much I can charge.

Often a client does not have the software needed to reload everything or doesnt know what data is important and wants to reformat as a last choice.

However sometimes I just mention the normal $89 fee for virus cleaning and they wince like I stabbed them in the heart. But keep in mind a reformat and reload can take much longer. I did a reload of one of those stupid HP media center latops and it took hours, after that it took a couple more hours to load all patches, driver updates and client software. So in the end I am not sure which was the better choice, a thorough clean or a reformat and reload.

 

[jhoppe]

MHCG and gunslinger said it best...essentially, this is a production environment. What will cost the customer the least amount in terms of money, frustration, and lost time is the best option. More often then not, it seems to be a format. As long as the user is then educated to keep their computer as clean as possible, they will be happy and your job will be done.

 

[JRDtechnet]

I always go for the repair route over format, my job isn't to save customers money it to get their computer back up and running...hopefully even better then it was before they even got the virus/malware.

I'm not sure how you guys doing 2hr format and reinstalls are doing it but you must be better then I am because re-installs for me take a GOOD 4+ hours. Backing up all documents and e-mails, zero-fill format so the HD is like it was from the factory, then install windows, install drivers, get updates, create new user accounts, transfer the backup back onto the computer into the correct user folders, reinstall all their software, ah but some of their software was programs they downloaded...go online and find and download the software...install that. Finally after doing all that you better bet the client is going to be like where oh my icons are all out of place can you put them back where they were before?

Now if you guys can tell me how in the world you can do that in 2hours then please tell me!!

 

[bmetman]

I think that although formatting should be a last resort we as technicians should be able to assess a pc fairly quickly and know whether or not a format is needed. As a business owner it is not advantageous to spend hours removing a multitude of viruses no matter how much fun it may be. That's right I said it was fun (insert geek joke here). We need to be upfront w/ our customers and give them a choice. If I am making headway on an infected pc after about a half hour I will continue w/ removal. But if I am removing viruses and creating other problems in the process I need to make the call. Sometimes the newer viruses get so interlaced w/ the OS they are almost impossible to remove in a timely manner. So although formatting is a last resort it has become a necessity due to the complexity of today's malware.

 

[gunslinger]

Now if you guys can tell me how in the world you can do that in 2hours then please tell me!!

Simple answer: It can't be done.

The only way I can see a reinstall going down that fast is if the computer in question had very little data to back up and it had a recovery partition.

If you are looking at backing up multiple accounts and many gigs of data plus reinstalling user software , 4 hours is a very conservative estimate.

 

[Simmy]

Now if you guys can tell me how in the world you can do that in 2hours then please tell me!!

The way I do it is;

• Acronis - create a full and verified backup image. Usually with the acronis boot CD copying the image over the network onto the file server. That takes 5 minutes to setup and then I can get on with other things.
• Create an unattended and updated Windows CD (SP3/IE7/WMP10/.NET etc) with automated driver pack installation and Windows Post Installer to install AVG, CCleaner, Firefox, SuperAntiSpyware and any other software - Once I've set it to do a full format of the hard drive, the setup will run to completion without touching a button. Again I can walk away and work on other machines and again it takes 5 minutes to setup.
• Once windows is installed, I'll create a shared directory and transfer the Documents and Settings folder to the customer machine from the backup image. Another 5 minutes to setup.
• Setting up user accounts and moving MyDocuments/iTunes Music/Emails/Favourites/Desktop Icons is the part that takes the most time but is generally done in an hour.
  
  The process generally takes longer than 2 hours to complete, but in terms of time I actually spend working on it, it's very rarely over 2 hours. Also, I'll only do a format at the office, never on the customers premises.
  
  

 

[Andyuk2007]

but simon, If you are using acronis to create an image of a customer's infected computer wont you be just putting all those viruses back on when you blank the drive and do a restore of that image ?

because viruses tend to be deep in the OS system files

 

[Simmy]

True - that's always a risk when backing up a customers files, even if you don't use acronis. You can never be sure that the backed up files are 100% clean, you can only do your best and use common sense.

I have Kaspersky running on the file server and AVG running on the customers computer which flags anything up when the files are being transferred. Scanning each file on server and client machine can make the file transfer a bit slow though

Also, once I've transferred back MyDocuments/iTunes Music/Emails/Favourites/Desktop Icons, I'll delete the remaining Documents & Settings folders. I then run a full scan with SuperAntiSpyware, but I've never detected anything up until now and I've never reinfected a machine by restoring personal files I won't restore exe/dll files either because they won't be of any use on a freshly installed OS and could potentially be infected.

I only copy things like pictures, word documents, mp3s. If a customer has a copy of the iTunes.exe installation for example, I'll delete it and reinstall it using the copy on my file server, which I know is clean.

I also try to keep the acronis image for 2-4 weeks. This way, if a customer finds a file is missing I can look in the archive and email or post the file to them. I've only had to do this a couple of times though

My method works well for me so far!

 

[Andyuk2007]

thats a good method simon, I usually just back up a customers files to an external hard drive that i have here and wipe the drive then install there OS then scan there files with AVG then i restore there information that i backed up such as the user account in documents and settings e.t.c.

How is it different to using acronis Would i need a file server like you have to use it properly ?

P.S The local Advertising booklet came out today and My advert is on the 2nd page, if you remember I had the price removed and also decided to do a post card size option.

 

[Simmy]

How is it different to using acronis Would i need a file server like you have to use it properly ?

P.S The local Advertising booklet came out today and My advert is on the 2nd page, if you remember I had the price removed and also decided to do a post card size option.

Nope, you just need somewhere to copy the files to. That could be a USB hard drive plugged into the customers computer or you might have to take the customers hard drive out and plug it into your computer.

The beauty of backing up over the network is you don't have to mess about with removing hard drives, especially if opening the computer/laptop voids any remaining warranty. Just make a shared directory on a hard drive with plenty of space and network the computers together with a switch/router. The acronis boot CD will let you browse shared directories on the network.

 

[Trouble-Shooter]

One method I came up with for removing even the worst malware completely is to locate a file that I know is directly linked to the infection and through "properties" or details, I make a note of the exact time and date it was installed. I then search the entire computer using a third party file search tool for files created within minutes of the one I started with. Then, it is just a matter of figuring out the bad ones. Time of installation is one of the common links all the files connected will share. I understand that this is not the perfect solution to every problem, but when one stubborn virus is left after everything else has been cleaned, this method has worked for me to get through that last one.

 

[abe]

If the computer boots then I give the customer the choice betwen format or cleaning, however if its a new virus I haven't come across I go for a cleaning so I can see how this new virus works. (any extra time is at my on cost)

 

[Clark W. Griswold]

For those of you that remove the viruses, do you run a repair on the O/S after if the cleanup was a major one?
I cleaned up a person's PC that had hundreds of infected files, and quite possibly some corrupted system files. I gave him the option, and he didn't want to reinstall everything or pay for me to do it.

I'm wondering if I should have run the repair disk after. Anyone do that regularly?