[RedHelix]

Dude, no offense, but that's incredibly petty.

[valis]

actually, I think it's pretty funny and rather opportunistic.....I've had to fix so many 'fixes' by GS that I'm thinking about doing the same thing.....

[JStergis]

Originally Posted by valis

actually, I think it's pretty funny and rather opportunistic.....I've had to fix so many 'fixes' by GS that I'm thinking about doing the same thing.....

Went to a place about a week ago...GS had charged them somewhere around 200$ to set up a wireless network on a desktop, 5 laptops, and share the printer and install it on all the laptops.

GS had accomplished setting up the DSL through the router which they called geekbase1 and secured with 64 bit WEP. They connected the laptops. They had apparently given up on the printer.

I spent 45 minutes there, secured the router with WPA, changed the bizarro-geekbase name to something that WASN'T the same as the neighbors, reconnected the laptops, and shared the printer (which wouldn't share because McAffee blocked it in the firewall).

They wanted to pay me 60, I said 40 and told them I could have set up the whole thing from scratch in 10 more minutes.

They were sorry they paid GS all that money.

[valis]

Originally Posted by JStergis

Went to a place about a week ago...GS had charged them somewhere around 200$ to set up a wireless network on a desktop, 5 laptops, and share the printer and install it on all the laptops.

GS had accomplished setting up the DSL through the router which they called geekbase1 and secured with 64 bit WEP. They connected the laptops. They had apparently given up on the printer.

I spent 45 minutes there, secured the router with WPA, changed the bizarro-geekbase name to something that WASN'T the same as the neighbors, reconnected the laptops, and shared the printer (which wouldn't share because McAffee blocked it in the firewall).

They wanted to pay me 60, I said 40 and told them I could have set up the whole thing from scratch in 10 more minutes.

They were sorry they paid GS all that money.

bolded part made me laugh out loud.

Our neighbor and us are pretty close. We baby-sit each other's kids, etc, cover when the other family is out of town, turkey day, that sort of stuff. So last year, they were going to buy a new pc. As I work in the IT industry, they at least consulted me. I told them 3 things:

1. Don't buy a Dell for home use (because if something breaks, I can't crack the case and work on it)

2. Don't buy Vista yet.

3. Don't buy from Best Buy, and if you do, do NOT get the extended warranty.

Well, they wen't a combined 0-4, but they ARE my neighbors, so I said that if anything goes sideways, for the love of all that is holy, do NOT call GS. 6 months laters, I get home and the the Bug O Doom out front of their house. Wait patiently until it leaves, then give them an hour or so to recover, then mosey over for some small talk about baseball or something.....5 minutes, and they had steered me to their pc, which had taken on an infection due to the hubby looking at inappropriate sites. The GS dude was going back to get his super disk and reformat the machine. I grabbed my usb key, which has hjt and a few other fixes, and had it up and running in about 20 minutes, infection free. Threw on ZA firewall, let the wife deal with the hubby, who was mad enough from THAT that when the GS dude showed back up it was a fun scene.

Apprently the conversation went like this:

Neighbors: Everytime we go to google, we get redirected.

GS: Well, that's serious. I need to reformat your pc. Be right back!

oh well. Live and learn. At least the GS dude had the stones to ask me what I did and how I did it, which I thought was at least prospective, in that he was willing to learn. But the fact that he didn't KNOW what was wrong, and that his answer was to immediately hit it with the biggest hammer he could find, was somewhat disconcerting.

[RedHelix]

As a former GSer who probably hates the company more than any of you, I can at least empathize with the guy who visited your neighbors house. Most of the time, DAs (double agents; the in-home guys) get atrociously overscheduled by the support hotline and have to take up to a dozen in-home calls in a given day. We all know that removing malware can take anywhere from 10 minutes to 10 hours, and sometimes they just aren't able to invest the time it takes when the problem can quickly be solved by a simple (and extremely effective) reformat. I'm sure that it's also because much of the security software offered today just isn't powerful enough to make removing today's rootkits a simple, one-click automated process, and GS doesn't want to be held liable for leaving someone's machine compromised.

Also, it's admirable that you immediately knew what software to use to resolve the issue, but I hasten to point out that ZA, HJT, and many other security tools you take for granted aren't authorized for use by GS. (Although they were talking about authorizing HJT when I left.) Employees using them on the job could result (and has previously resulted) in a lawsuit. And the software they ARE authorized to use is laughable at best, which prevents them from doing their jobs properly.

It's difficult for me to put myself in that position now of course, as I don't work in line-level IT anymore. I'm also biased because the only situation where I don't think a format is appropriate to fix an issue is on a hot server, and most other resolutions aren't a good investment of time.

I dunno... I just think it's a bad practice to run a few malware scans and assume you've gotten rid of the infection when the scans come up clean and the quirky problem you were having is solved. You have to consider the enourmous complexity of today's rootkit techniques, which confound even the most powerful heuristics-based scanners because although detecting them is easy, automated removal is not consistently reliable.

Bottom line is, if I were to find a serious malware program on my machine, I would not be comfortable doing any financial stuff until after a format.


Yidunno

(I like turtles)

[JStergis]

Originally Posted by valis

bolded part made me laugh out loud.

Our neighbor and us are pretty close. We baby-sit each other's kids, etc, cover when the other family is out of town, turkey day, that sort of stuff. So last year, they were going to buy a new pc. As I work in the IT industry, they at least consulted me. I told them 3 things:

1. Don't buy a Dell for home use (because if something breaks, I can't crack the case and work on it)

2. Don't buy Vista yet.

3. Don't buy from Best Buy, and if you do, do NOT get the extended warranty.

Well, they wen't a combined 0-4, but they ARE my neighbors, so I said that if anything goes sideways, for the love of all that is holy, do NOT call GS. 6 months laters, I get home and the the Bug O Doom out front of their house. Wait patiently until it leaves, then give them an hour or so to recover, then mosey over for some small talk about baseball or something.....5 minutes, and they had steered me to their pc, which had taken on an infection due to the hubby looking at inappropriate sites. The GS dude was going back to get his super disk and reformat the machine. I grabbed my usb key, which has hjt and a few other fixes, and had it up and running in about 20 minutes, infection free. Threw on ZA firewall, let the wife deal with the hubby, who was mad enough from THAT that when the GS dude showed back up it was a fun scene.

Apprently the conversation went like this:

Neighbors: Everytime we go to google, we get redirected.

GS: Well, that's serious. I need to reformat your pc. Be right back!

oh well. Live and learn. At least the GS dude had the stones to ask me what I did and how I did it, which I thought was at least prospective, in that he was willing to learn. But the fact that he didn't KNOW what was wrong, and that his answer was to immediately hit it with the biggest hammer he could find, was somewhat disconcerting.

I almost never resort to formatting a machine. I've seen a couple of cases where I've been working many hours at getting rid of the malware and viruses seem to be multiplying like squirrels, and I get frustrated, back up everything on the machine, scan all that from another box, then wipe it. That's rare though. Usually I can get rid of most junk within 45 minutes, and that's a heck of a lot easier than formatting and restarting from scratch.

On my machines, I once had a virus that ate the master boot, but of course I had an image from the night before that I just threw on and scanned throughly. It was fine till the PSU blew, and because it was a several year old Dell, it was a custom PSU, with the wires on the 20-pin mapped in odd places. Couldn't find one for a decent price and it was a PIII 800 MHz with little more potential anyway.

Since then, I haven't had a single piece of anything, even as small as a tracking cookie in 3-4 years. I used to scan just about every day, but lately it's been once a month if that, never get anything at all. Heck, this box runs really nice for a 1.2 GHz Athlon. Handles Dreamweaver, Flash, Imageready and Photoshop 6 simultaneously without flinching.

It seems the more GS setups I see, the less respect I have for them. The other day I was in the store and one of them was trying to tell me a PCI-E slot looked exactly the same and was compatible with a PCI slot, it was just faster. None of the PCI-E types look anything like a regular PCI to me.

http://upload.wikimedia.org/wikipedi...PCIExpress.jpg

[JStergis]

Originally Posted by RedHelix

Also, it's admirable that you immediately knew what software to use to resolve the issue, but I hasten to point out that ZA, HJT, and many other security tools you take for granted aren't authorized for use by GS. (Although they were talking about authorizing HJT when I left.) Employees using them on the job could result (and has previously resulted) in a lawsuit. And the software they ARE authorized to use is laughable at best, which prevents them from doing their jobs properly.

That could cause some issues in solving the problem, I couldn't imagine not being able to use HJT or anything of my choice. I just keep every decent security app on my flash.

[new tech guy]

I pick a setup that works and stick with it. I find avg free does a good job and combine that with comodo, spybot, and ,spyware blaster on xp and im set. Usually i set that up as most people insist on mcafee but i find that setup smaller, lighter, and very effective. I am not an expert but i work to the best of my ability.

[valis]

Originally Posted by JStergis

It was fine till the PSU blew, and because it was a several year old Dell, it was a custom PSU, with the wires on the 20-pin mapped in odd places.

this has been bugging me for a couple now.....a custom psu is completely understandable, but WHY was the 20 pin mapped weird? That would mean a corresponding weirdness on the mobo side, I would assume......and did you customize it? I know in my 'customizing' of rigs, they have turned out a bit sideways in the learning process.

"See, to turn it on, take this screwdriver.............."

[n2gun]

IMO Some pc's had the psu wired different so you had to go the company you bought it from for a replacement. More of your dollars in their pocket!! Of course the price was substantially higher than an off the shelf psu.

[valis]

Originally Posted by n2gun

IMO Some pc's had the psu wired different so you had to go the company you bought it from for a replacement. More of your dollars in their pocket!! Of course the price was substantially higher than an off the shelf psu.

the bmw of the pc world, eh? Makes sense. I remember when my buddy's muffler on his beemer went south, took it to midas, close to $300 for a new muffler. Proprietary bend in the tube, dontcha know....

[The_Oracle]

now, first of all, if GS start using software that is free for personal use and making money with it, they'll find themselves in court next morning.

i'll have to second the statement that a machine that has been cleared of spyware and viruses isn't exactly trustworthy anymore.

as someone said, it can take anything from 10 minutes to 10 hours to clean an infected machine. from a financial point of view it often does not compute to do that. to keep the financial damage at bay, 'the biggest hammer' is often the appropriate method. although i am interested in what has been causing the problems every now n then (out of occupational curiosity) the customers don't like the notion to pay for the job more than what a new machine would cost even more so if the outcome is questionable.

to help out a friend or neighbour cannot be compared to a professional job where you're obliged to obey certain rules and regulations.

[valis]

I pretty much disagree with the 'biggest hammer' part, especially if you don't know what you are infected with. To date, I only know of one virus out there that is pervasive enough to warrant a reformat, although I am sure that there are others out there. I've fixed a LOT of computers with hjt and then whatever tools were necessary to remove the infection, and I don't think I've spent more than 2 hours on any given machine.

Granted, I know hjt and have most of the removal tools already at my disposal, so I don't have to research for them, and can recognize most on sight, but still, if their solution is reformat without even knowing what the problem is, that is rather extreme in my view. Again, all the GS tech was told was that they were being redirected. He fiddled with IE a bit, couldn't fix it there, so decided to reformat the machine.

Now, I didn't ask him if he was going to reformat or simply recreate the profile keeping the data intact. But as they (my neighbors) had a pile of data on there, from pics to financial papers to what have you, I had a rather vested interest in their not losing their data. And again, I had them up in about 20 minutes or so.

I totally understand that GS is handcuffed by the fact that they do not have legal access to the tools necessary to correctly handle many of the more common infestations, and also understand that they do not want to take ownership of a machine that has been infected, as if it respawns, or they damage the registry, then they could be in deep yogurt.

but I still think that they should at least tell the customer the options available to them, and what they plan to do to fix it, and if they choose not to have a reformat or a new profile with the current data system left intact, then that can be their choice, not GS's to make.

But yeah, I see where they DA's would be overworked and the biggest hammer is the quickest fix to the issue. Besides, now that TrendMicro has acquired HJT, it's only a matter of time before they develop a 'commercial' version that does exactly the same thing, only worse.

[The_Oracle]

read the EULA, under section 1 you'll find this:

install the Software, for Your own use only.

now installing this software on clients' machines and charging them for it is certainly a violation. if you don't mind reading further (section 5), you'll find out that the AnalyzeThis button submits the data from your HijackThis log to Trend Micro for use by them and their partners. which imho gets HJT very close to being spyware itself.

and of course the customer should have the right to choose which way to go from the options presented in a decent and objective manner.

[JStergis]

Originally Posted by valis

this has been bugging me for a couple now.....a custom psu is completely understandable, but WHY was the 20 pin mapped weird? That would mean a corresponding weirdness on the mobo side, I would assume......and did you customize it? I know in my 'customizing' of rigs, they have turned out a bit sideways in the learning process.

"See, to turn it on, take this screwdriver.............."

Yup, the mobo was a weirdo dell one too, that's why I couldn't throw a standard 20-pin on it. It was an older Dell with no real room for expansion (maxxed out at 512 MB RAM, no AGP, one CD bay, a floppy bay and a HDD bay, that's all.) It was actually an extra unneeded box at that point anyway.

Out of curiosity, I plugged a standard PSU into it, and there was a spark and I'm pretty sure the mobo blew, considering the size of it. PSU still works though.

Actually, funny about the customizing.

My current rig is a circa 2000 Compaq chasis, compaq board, an AMD processor I found for it (1.2 GHz), a 120 gig WD HDD, yada yada
Basically random parts I threw together.

The front of the case has no cover, because I didn't like the looks of it, and I had destroyed the power button anyway. It's metal with the CD drive and other covers sticking out several inches, the power button requires really small fingers or a pencil or something, it's hillbillyish really, but what do I care, it runs at 80 F on the CPU, and it sits below the desk so I never look at it anyway.