What is your average PC Cleanup timeframe? [closed]

Question

What timeframe do you communicate to your customer?

How long (total time) does it take to fully clean an infected PC?

How much time do you actually spend touching the machine?

Answer 1

You don't clean up "infected" machines-- you level them and start over. Anything less is asking for the malicious software to come back, and a disservice to your Customer. It sounds fairly blunt, but malicious software is becoming quite advanced, and much has moved beyond the skill of the average PC technician to remove. Automated removal tools are in an "arms race" with the malicious software authors, and since the Internet lets malware authors "release early and often", I tend to feel like they've got a leg-up in that arms race. (They don't need to go thru the same "QA" hoops, etc, that an anti-malware signature update goes thru. They can twiddle some bits to defeat signature analysis, recompile, and release.)

I don't have problems with malicious software at my Customer sites. I don't allow users to run as 'Administrator' on their computers.

When PCs do get damaged (typically because of hard disk drive failures), I restore the disk-images of the factory loads of my Customer's machines that I keep. I have software configured to install automatically when PCs join the Customer's domain. I don't allow users to store data on their local hard disk drives. PCs are interchangable parts and should be stateless.

Answer 2

I have to agree with Evan. We don't let users save data on their local machines, we take note of any customisations for individual departments or even machines, and the time to "clean up" an infected machine is exactly the same as the time to build a new new machine for that department and we know how long that a rebuild/new build takes. In the event of any problem that can't be fixed simply and guaranteed fixed quicker than the rebuild time for that workstation then we just rebuild.

To be honest, virus infections are virtually unheard of on our LAN. I'm honestly struggling to remember any incident in the past 5 or 6 years that wasn't someone bringing in a virus from home on their memory stick that got blocked by their machine's virus scanner and got fixed by scanning their memory stick for them and telling them how to get free AV installed on their home computer. If you're constantly fighting infections that have got embedded into workstations then something is very wrong.

Answer 3

I think it would have to be variable, depending on the level of infection. You've got to be up front with the customer, and let them know that in some cases, all you can really do is copy off their important data and wipe the machine.

In real world terms, it depends on how busy you are, too. Assuming you've only got one machine to focus on, it'll go faster than if you've got a gamut of machines.

In the end, though, the real answer will be "I don't know, how long does it take you?"

BTW, in a corporate environment, Evan's answer was exactly right. Home users make things complicated. Stupid personal data ;-)

Answer 4

I agree that a system should be reloaded.

But to answer your question, I spend anywhere from 1-3 hours on a machine.

I install all the normal tools, spybot search and destroy, avg free, sysinternals autoruns, etc. Then I just plow through it till it's done.

My recommendation is always to backup the data and reload.

Answer 5

With very few exceptions, I just reimage any affected PCs here at my workplace.

"Frequent-flier" users that have laptops and demand local admin rights on the laptop wind up with a slightly smaller HD partition that they expect-- because I put a ghost image of the known-good base system in the space they think they're missing.

In the few cases where I can't reimage the PC due to rather annoying proprietary software that doesn't play well with reimaging or multiple reinstalls, I'll spend up to four hours with regedit, spybot, and other various tools. ( Beyond four hours, it's more cost effective to tell them to go buy another activation of the software for after I reimage the PC. )

This reimage-everything policy has had an unintended side effect here: users think that I can fix Any Virus Problem Within Two Hours, and bring me their personal desktops/laptops from home.