Ethics in Formatting?

[tartis]

For those of you that remove the viruses, do you run a repair on the O/S after if the cleanup was a major one?
I cleaned up a person's PC that had hundreds of infected files, and quite possibly some corrupted system files. I gave him the option, and he didn't want to reinstall everything or pay for me to do it.

I'm wondering if I should have run the repair disk after. Anyone do that regularly?

I had a PC just the other day with hundreds of infections, and I spent about two hours cleaning it up. When I was done, I still could not get Internet Explorer to pull up any web-sites, so I ran the XP repair which fixed the problem, or so I thought. I could finally get to the web, but if I tried to go anywhere except the home page, 64 windows XP sessions would start.

I eventually called the customer and got the ok to format and start over. It took me about 2 hours to re-install the OS, Open Office, Acrobat Reader, XP SP2 and 3, Microsoft patches, Gimp, Java, and Flash.

 

[Blues]

My general rule of thumb is that when its over say 15 different infections I reccomend formatting. I do this becuase of time it takes of one vs the other and the reduced success rate of cleaning the PC at that point. I admit 15 is to me kinda low but usually the systems have 1-5 and then skip on up to 20-50 and then we get to 100-300 and finally 700-"wtf did you do?" each scenario worse then the prior and more work involved and less chance of success.

 

[imjonah]

More than My documents, favorites, outlook files

I have seen people recommend copying before reformatting,

but in addition I think it helps to do a search using *.doc, *.jpg, *.xls, and maybe one specifying files modified in last 3 months that way you can discover other directories where files they want to save may be stored.

 

[AtYourService]

I rarely ever reformat usually a good dose of combofix/malwarebytes/spybot/hijackthis/AVG usually fixes the problem and each program finding other problems that the others didnt find i've actually incorporated this into the technibble usb tools to have 1-click installs so there is no interaction, but be wary about using the usb because newer virii like to copy themselves over the drive now

 

[enuro12]

When i first started working on computers, i formatted a lot. I've always used the same method to determine whether i should format or not.

After working on a problem for 1 hour, its time to stop. Re-evaluate where your at. And consult with the customer.

I've just spent 1 hour of your money, i'm approximately x amount of time from fixing the issue. So it will cost y to fix the issue by continuing on the current course. I charge w to reformat and v to reinstall all your apps, and restore your pc to the functioning state that i arrived.

%99 of the time you will just go with the most economical method for the customer. In some cases the customer cant replace some version of software, so the only choice is to fix the problem.

With that said, NOW after working on 1000's of pc's. Even the most rouge Virus/Trojan takes minutes to fix. Last year (2008) i only had 2 challenging pc's that required a full hour each to fix. So i do very few formats for those issues.


Format Practices (cover my ass)
As a legit business i carry 2,000,000 in insurance coverage. But that's not a license to be stupid or take chances.

ANY time i format a customers pc i ALWAYS make an image first. In the event of critical data loss (when they conveniently forgot when you asked what was important) i can ALWAYS get back to their original state before i touched it. This also protects me in the event of a lawsuit. The worst i can do is return their pc back to the state i got it in. After 30 days i consider the image disposable, but with the size of data drives on my server, i can leave them there for over a year.

 

[JRDtechnet]

For me it's not getting rid of the virus so much as getting their computer back in decent shape. Most people who's computer is infected doesn't do any maintenance at all, never deleted any temp files, never defraged, their pagefile is in 50 places, there running sp1 or sp2, etc, etc.

So 90% of the time removing the virus easy, but performing 3yrs worth of maintenance = time consuming.

 

[RyanMeray]

Had a system on the bench that was hit with an EXE infector. 200+ program executables corrupted by this virus.

Gonna have to wipe it.

I think this is the first computer in about 3 months that I couldn't resurrect by sheer effort. Always a bummer.

 

[TimeCode]

Had a system on the bench that was hit with an EXE infector. 200+ program executables corrupted by this virus.

WOW!!! Can't wait to see that one on my bench.

 

[RyanMeray]

WOW!!! Can't wait to see that one on my bench.

I just had a second one. It's the Virut infector virus. This does NOT bode well.

 

[14049752]

I just had a second one. It's the Virut infector virus. This does NOT bode well.

I've been getting a lot of those, too. We accidentally contaminated our flash drives with it a couple of weeks ago, luckily we didn't spread it

 

[RyanMeray]

I've been getting a lot of those, too. We accidentally contaminated our flash drives with it a couple of weeks ago, luckily we didn't spread it

Fantastic. Just when I thought things were getting too easy.

I was tipped off both times because Anti-vir reported the files extracted during installation didn't pass the CRC check.

 

[reesk92]

heres a idea iv come across that not manh have mentioned here why not put all your av toolkit on a sd card and then flick the write protect on then it shouldnt het infected just put the sd inside one of those cheap usb sd card sticks and your sorted

 

[14049752]

heres a idea iv come across that not manh have mentioned here why not put all your av toolkit on a sd card and then flick the write protect on then it shouldnt het infected just put the sd inside one of those cheap usb sd card sticks and your sorted

I do exactly that, but I was careless. I have two flash drives that I maintain and I plugged the regular (non-write protect) drive in without thinking.

 

[topshelfpc]

I wonder if the windows XP repair installl is a common practice for other techs after doing a thorough virus removal. I do this every time I clean an infected PC and 99% of the time the PC is returned in a like new condition, virus free with all of the customer's data and software intact. It may take more time to do this, but my philosophy is "Under Promise, Over Deliver!". For this service I usually charge a flat rate of $250 USD.