"good" clients getting re-infected -- how do YOU handle it?

[ASDCR]

i have some long-time loyal clients that trust me implicitly

i value their patronage and i like them as people - i count some of them as friends in fact

yet, they keep getting infected with viruses - you know, the rogue software that "says" you have a virus when in fact *it* is the virus!

over and over again



now, i'm a business - i don't exist just to "help" people because i'm "nice"

and, if i work for free while i could be getting paid to do other work.. thats what you call an "opportunity cost"



but i hate having to charge the same ppl (good loyal customers) over and over again

and its not like these ppl are going to porn sites or gambling sites



so i'm just putting this out there - how do you handle this situation?

you don't want to alienate your customers, you want to encourage loyalty and reward and incentivize return customers as much as possible



what do i do for clients caught in the rogue virus vortex? do i lower my rate for them?

what do you say??

 

[Martyn]

My question is do you do more than just remove the malware? I haven't had one single person come back with a virus or malware since I did the fix. I update Java, Flash, Acrobat Reader and make sure they have decent anti virus, Malwarebytes and Superantispyware installed. I install CCleaner and show them how to run this once a month or so. I document everything on my worksheet which is easy with PCRT. Maybe I'm just lucky but a decent invoice and what I have just mentioned does the trick.

Actually when I leave the call I usually say that I don't want to see them again for viruses I just want their referrals.

 

[ASDCR]

you get a flat and bring your car into the shop - they fix it but you run over a pothole the same day and get another flat

its not the shop's fault - "maybe" you have some culpability because you can't steer away from potholes ---- but more likely its just the nature of the beast.. the roads are bad



it almost sounds like you're saying *i'm* doing shoddy work - if only i did what you did i wouldn't have clients getting computers reinfected - ??

remember, all that's required to get zapped these days is visit the wrong website (and the websites themselves don't have to be compliant in the scheme - it could just be an ad on the website)


maybe your clients *are* getting reinfected, but they just don't bring them back to you -- maybe you charge too much and they take their computers to a cheaper competitor - ??




at any rate, i'm asking other techs who DO have repeat/loyal customers who DO get numerous reinfections... how they deal with it

 

[Martyn]

Sorry I wasn't trying to offend you with my post. I'm telling you what I do that's all. I get referrals often based on my work so it's a good sign they are not reinfected. A big site here Autotrader(car sales) was infecting visitors who clicked on an advert. If you do all I do and get infected then I'm looking at the answers others posts because I'm genuinely interested. Btw I'm no expert. Don't be so touchy

http://www.ozzu.com/website-securit...ection-against-iframe-injections-t103793.html

 

[Kitten Kong]

Another way of putting it, is how do you attempt to educate your loyal clients how to stop being infected. Do you simply remove the virus, show them how to run their chosen a/v and have done with it?, or go the extra mile.

I have to agree with Martyn on this one. After a malware removal, I update java, flash etc, install mbam, and sas (great opportunity to upsell a sas pro license here).

I have many many loyal clients who come back to me time and time again. If they have had a virus removal in the past, and a couple of weeks later receive another, then I go into detective mode. Find out exactly what sites they have been viewing, checking their internet musings, for anything which appears out of the ordinary.

If one comes back, and for eg they have norton or mcafee installed, I say something along the lines of, your chosen anti virus, is good, but it is not catching the virus, you need another product too. There are some free alternatives out there, whereby you have to check it yourself, or as an alternative you can purchase a professional version of eg SAS, which will automatically scan, for you. Even though we know that norton and mcafee are rubbish, if the client wishes to stay with them for what ever reason, note it on your job sheet. There is nothing more you can do.

Nothing is 100% secure, else we wouldnt be receiving the amount of virus calls we do. We simply have to advise and educate the best we can.

I have no hesitation in charging my client again if a virus has returned, and it is through no fault of my own. Hence the detective mode. If you can actually prove when and where the virus came from, with a printout theres your proof.

 

[ATTech]

you get a flat and bring your car into the shop - they fix it but you run over a pothole the same day and get another flat

its not the shop's fault - "maybe" you have some culpability because you can't steer away from potholes ---- but more likely its just the nature of the beast.. the roads are bad



it almost sounds like you're saying *i'm* doing shoddy work - if only i did what you did i wouldn't have clients getting computers reinfected - ??

remember, all that's required to get zapped these days is visit the wrong website (and the websites themselves don't have to be compliant in the scheme - it could just be an ad on the website)


maybe your clients *are* getting reinfected, but they just don't bring them back to you -- maybe you charge too much and they take their computers to a cheaper competitor - ??

I'm not sure why you took offense to what he said; he didn't blame anything on you and gave you sound advice on what you can do to help prevent the situation from occuring.

at any rate, i'm asking other techs who DO have repeat/loyal customers who DO get numerous reinfections... how they deal with it

Same as I do with every other client: clean the infection, ensure antimalware software is in place, update the machine, remind them to not download bad things, take the money and leave. What else can you do? Are these people trying to claim it's your fault? If not, then it seems like a source of consistent income.

 

[strollin]

One thing you might consider for a client that keeps getting re-infected would be setting up SandBoxie for them.

 

[ASDCR]

hmmm.. going to have to try that out

thx

 

[myPCTechs]

We take the time (usually 30 minutes) to sit down with every client who comes in with a virus infected computer. With our clients we will install Firefox and noScript, make sure all AV software is auto-updating, and educate them on the usage of Firefox/noScript and safe browsing.

If the client refuses to install and use Firefox and noscript we have them sign a document stating that they have refused to do so. I can tell you that the clients who take our advice are 99.9% non-returns for viruses (but come back for other reasons).

I have found that 95% of viruses come in through surfing via IE and removing a virus is pointless if additional measures aren't taken. Most of the virus infections come from a site that the client visits on a regular basis. As soon as they are clean and you leave, they will go right back to that site and wind up in the same boat.

Giving them control over scripts with noScript puts the client in control and makes them responsible for the security of their machine.

 

[kevinjhaag]

Sandboxie or Imaging

One thing you might consider for a client that keeps getting re-infected would be setting up SandBoxie for them.

+1 for SandBoxie. My favorite and I have it on all my computers.

Or you could install the premium version of Comodo Internet Security. Look into their Virus-Free Guarantee. And it has a builtin Sandbox feature but is not fully featured and configurable like Sandboxie.

Or image the computer for quick reimaging.

 

[Nodak]

Is that basically the same as Kaspersky Safe Surf?

 

[wtigger]

I also tell my customers to use Firefox, and I install the AdBlock Plus plugin... Reduces the risk somewhat.

Regarding NoScript, I use it myself, but I haven't had too many customers that are able to grasp it... Most people I deal with are barely able to use a computer, and many shouldn't even touch one Much less own one...

 

[16k_zx81]

http://www.technibble.com/forums/showthread.php?t=26545&highlight=questioning+intent

May be relevant to the question.

 

[kevinjhaag]

Sandboxing

Is that basically the same as Kaspersky Safe Surf?

I'm not sure but it looks like it is by the little bit that I have just checked out. I haven't messed with Kaspersky since 2009 but it looks like they have somewhat built it in too their product. Talk about being behind the game. Sand-boxing has been out for a long time. Its been built-in into Comodo for at least 3+ years. I did love Kaspersky because it is a excellent Antivirus. Almost the best I think. But the 2009 version had issues when I tried using it. I would have to downgrade customers back to 2008 and just use the 2009 license to renew it. I've now basically have converted most of my customers over to Comodo or Security Essentials and Sandboxie.

 

[Ccomp5950]

Are you installing antivirus software on your customers computers? I install avast free on there for now.

I also install Spybot S&D and set it up to update and "immunize" daily through Windows Scheduler. I have it do this in the background where the customer doesn't even have to deal with it or even see it.

On Mondays and Thursdays it does a full scan and clean.

One thing I've been doing recently is uninstalling old versions of Java and Adobe and installing the most up to date versions. Java exploits and bad flash ads have pretty well been the case for viruses lately, though "Your package tracking" scam emails have been hitting a lot lately too.

 

[homebase]

Virus infections

You'll definitely want to make sure that their antivirus package is fully functional, and test it with the eicar virus test file. Make sure you update the Adobe flash, adobe reader, and java software, as the well-known vulnerabilities in the older versions of those applications are common targets. Also educate the customer about how fake emails pretending to be social networking updates, greeting cards, package tracking, bank notices, and so on are huge right now. Try to find out if the customer is unknowingly going to dangerous sites on the internet such as free TV show streaming sites, music downloads, torrents, other "dark alleys" of the Internet, and so on.

 

[nesrinamb]

It seems to me that your pretty much suffering from guilt because good clients keep getting bad luck. My advice to you is to fallow the advice all the other techs have posted in this thread. But also educate your clients on malware and how it spreads such as through ads and facebook.

In my experience after I give clients a web safety brochure they suddenly seem to never get any viruses but do come back for other services such as ram upgrades or a new computer setup.

 

[iladelf]

For the first time since I began doing this type of work in 2001, I got infected last week. I was simply surfing a potential client's website, when, "BAM", up came a fake AV, that took me awhile to kill. Made my .exe files non-functional after cleanup, until I found a fix for that online (with another computer, obviously).

I was practicing ''safe hex"; no pRon surfing, and using Firefox with AdBlock Plus and the latest Flash.

I'm guessing the client's website was the culprit. My point is this; can happen to anyone.

I am now using Sandboxie, and finding it a usable alternative that I will suggest to my customers if they are still getting infected after switching to FF and ABP.

 

[ASDCR]

thanks for all the really good answers everybody

helpful!

 

[Styxbound]

A year, year and a half ago I had someone like that repeatedly getting infected and started feeling bad about repeated charges. Think I was putting free Avast on the machines at the time. Finally I just went to her house, cleaned up the machine, downloaded SAS and MBAM and ran them and taught her how to. I probably spent 3 or 4 hours and didn't charge anything. She's never gotten infected again, has referred several other people to me, and calls me occasionally just to say hello. So it worked out for this one time I did something like this.