Meztiso

I put an ad in the yellow pages as an experiment to see how profitable doing computer repair might be, and I did my first job two days ago. I am evaluating the experience, looking for ways in which to improve it both from a "business" perspective and also in technical terms.

There is a local computer repair shop that seems to field a lot of requests for on-site repair, whihc they do not do. It occured to me that doing on-site repair might be a way to make some money by doing something that others won't do.

So when the customer (my first) called & said he could get to the destop, but couldn't do anything after that point. I assumed that it was a "freeze" situation and that it was possible caused by corrupt registry and din't think it would take too long to either fix the disk errors with chkdsk, remove the malware or even (if necessary) do sfc or even a repair install. SO I said that I could do the work "on-site" with a $50.00 minimum.

He said he had some work photos on the HD, and getting them off and stored safely was 1st priority.

When I got there, first thing I did was install his HD on my overclocked Opteron 165 system, thinking my system was so fast I could get (most of the) malware removed quickly, and the photos backed-up, before reinstalling his HD and troubleshooting whatever else might be going on.

Well the scanning took about 2 hours, and I just sat there with nothing to do while they ran. Not a very comfortable situation to be in, as the customer was sitting right there most of the time. There was a baseball game on, & he would leave occasionally to check on it.

The scans came up (mostly) clean, as did chkdsk, so I was a little nervous when it came time to reinstall the HD back into the customer's Dell.

The Dell booted okay, but once it got to the desktop, every program God had ever imagined was trying to get running. The two worst offenders were earthlink's suite of AV, spyware & firewall "protection", as well as Symantec's entire host of schlock.

When I looked at the HJT log & the MSCONFIG reports, I could see that in addition to the 20 or so programs associated with these two, there were several other programs that were probably bad.

But the system was so paralyzed with the Earthlink and Symantec that I couldn't even launch a browser.

So I turned off everything I didn't know for a fact was legitimate in both the services & startup and rebooted.

The system ran fine after that. Connected to the internet (his primary purpose for the machine) and ran smoothly.

It's an inadequate "solution" and I told the customer this. Let him know that I believed that he had a serious problem, probably malware, but also that the volume of "crap" (didn't acutally use this word) on his computer was at least part of the problem.

His situation is that Earthlink is his ISP, and he believes that he has to install the entire package of (crap) in order to get the Internet Service. Which I doubt, but I don't know Earthlink, either their business policies or their software's technical configuration characteristics.

Also, he had recently paid Symantec for a year to use their (crap) and was resistant to the idea that removing it and installing something free, smaller, faster and more effective would be a better option.

It was 10 pm and I had been there 3 hours, so I charged him $50.00, reiterated everything I had said about Earthlink, Symantec, Selective Start-Up etc... and left.

His system was more functional after I left than it was before I got there. He had access to his photos for back-up, could access the internet and got a general idea of what his situation was, so I don't have a problem with getting paid.

However, my conscience is tweaking me because I walked away from a computer that has not been repaired 100%, and I got paid besides.

Personally, I don't think I could have done this job "right" without spending a very long time with it, either at my house or the customers, because the only way to make this computer as functional as it could be made (doing it "right") is if I would be able to figure out how to uninstall as much of the Earthlink (crap) software as possible while still retaining the ability to connect to the Interent, while also figuring out how to allow Norton to remain installed without crippling the sytem.

AND, combing through the MSCONFIG > Starup & Services, as well as HJT in order to find the malware that I just KNOW is there.

I could have taken the box home and did the second part (looking for the malware) but I don't see how I could have made the bloat work without being at the customer's home & using their internet service.

I know this is a long post; but I intend this discussion to be "wide open" as I am looking at the situation from just about any perspective. Thanks for reading & thanks in advance.

Cellus

Many ISPs give away for free a complete suite of antivirus/antispyware programs. Unfortunately the quality of these suites are usually a lot poorer than the industry-recognized and award-winning programs. While many of these suites integrate the engines from reputable programs, they tend to do a very bad job making the rest of it and having it work properly. These suites are not necessary to attain internet connectivity.

Having two antivirus programs running on the same machine is a very bad idea as they conflict with each other and the file system, which seems to be the case here. One of them should be uninstalled (Earthlink for sure).

In terms of customer service in IT support, it is a really good idea to obtain certifications. CompTIA A+ is a good first certification to get, as an example. Certifications increase your capabilities and your visibility.

NWPhotog

1. $50 is way too cheap for 3 hours work. As a partimer (your current situation) I would set $150 as a minimum for that long. A fulltimer would charge $180-$300 for the same work but would have gotten results quicker. Spyware problems and boot issues take time. Don't under estimate and mess yourself over.

2. You should have tried safe mode or a boot disk before pulling the drive. Thorough scans take time. 2 hours isnt long at all.

3. While you didn't restore the computer to 100% performance you did resolve the major issues the Customer was concerned about for a bargain price. I would consider it a win win outcome for both of you.

Meztiso

This is also my perspective on the situation, but there is still a part of me that wishes I could have done it "right".

I am not sure about the strategy of running Safe Mode as a first attack. My thought was to run the HD in my high-powered machine to clean 98% of the malware, and then re-install and start troubleshooting.

I don't understand the reasoning behind your strategy. Had I booted to Safe Mode, I suppose I could have done the scans from there, but their virus definitions would be outdated, and I would still have to figure out a way to get my diagnostic programs installed on their computer (HJT, Ewido, Ad-Aware, etc...)

I could have disabled a bunch of stuff in Safe Mode first (instead of second) but even then there would be no guarantee that the malware wouldn't be active on the machine while troubleshooting it. Chkdsk would have taken much longer as well.

But I am still disatisfied with how things actually went, so if you have reasons I can think of I would be very interested.

My latest idea was instead of doing a "Full" scan of the HD, perhaps I could have limited the scans to just the "\Windows", "\Program Files" and "\Documents & Settings" Directories, as it seems that's where all the stuff lives anyways.

I guess I'm saying that right now I think that speeding up the scanning process is first priority. While I can see 2 hours for a scan is "reasonable", I really didn't like just sitting there doing nothing while it ran.

The other thing I did was run Clean-up, first thing, to get rid of the junk in the temporary internet files.

Oh (sorry, just sort of "free associating" here) one other thing I forgot to mention is that the customers "System Restore" file was HUGE. Like 4 Gbytes on an 80 Gbyte HD. I bet it took the scanning software a long time to get through that also.

I asked the customer how long he had the computer, he said 4 years. I'd be willing to bet that the System Restore had saved a record of every change that had happened to that machine since the day he bought it.

It was too late (already re-installed back in the Dell and the scans were done), but I was wondering if it might be possible to incorporate an "evaluation" of the System Restore Files while the customer's HD is installed on the (my) "repair" machine.

I think a System Restore file of 500 Mbyte - 1 gbyte is PLENTY big. How could I trim a 4 Gbyte System Restore file down while the HD is installed on another computer.

Is this possible ? If so, how would you do it ?

Thanks again.

Cellus

You can set a limit of how much space can be allowed for System Restore files on a hard drive by altering the System Restore settings:

Control Panel -> System -> System Restore -> select drive and press "Settings..." button.

I'll tell you right now, System Restore isn't a panacea. More often than not I find it fails to properly recover when it's needed. This is because System Restore stores the deltas of files, not actual files, like an Incremental backup. (I say "like" an Incremental backup - I'm aware Incrementals are useful and do work, but System Restore does not).

It is always a good idea to run scans in Safe Mode as the vast majority of active viruses/spyware will not run in this mode. If you suspect a viral infection you should run a Full scan, no matter the time required. If you are billing by the hour inform them on the matter of time required to run a virus scan - if you and/or the client decide it isn't worth the effort then backup essential files, wipe the machine, and start from scratch.

I have spent several hours trying to clean and infected machine only to format the client's hard drive and start from scratch (I didn't charge by the hour at the time). This ended up being a substantial waste of time. It is up to you to decide how much time should be invested in troubleshooting or simple disaster recovery, as DR is sometimes the only feasible option.

__________________
TSF Networking Team

HijackThis 5 Step Process
Donate!

infused

What he said... Are you in New Zealand?

$50/hr is WAY to cheap IMO.

Also, if you can, get a PE boot cd to boot to PE and do a check from there...

Otherwise, boot from safe mode. Get sysinternals process monitor, kill all processes not related to microsoft, then run hijack this to remove the nastys.

This job, IMO, could have been done in under an hour.

Meztiso

The $50.00 was getting paid for field experience. I would have (and have been doing for a few years now) the work for free, just to get the field experience. In part, to discover what I haven't seen yet, and also to develop some methods. Methods both in technical troubleshooting, and also methods of doing business. The discovery of porn was a new one that I hadn't experienced before, and one I wasn't ready for. Also Prices, and how to structure them.

Really ? Do you REALLY think so ?

I doubt very much that in an hour anyone could have:

1. Figured out how to crack open the goofy Dell case (they are all different, and they are all non-intuiitive)
2. Figured out how to dislodge the Hard Drive (it was also mounted in a very strange and goofy way)
3. Installed the HD on my dual-core Opteron 165 (with the 1 Mbyte of L2 cache on each core), which is running at 2700 Mhz, has 2 X 1 Gbyte G. Skill "HX" RAM running (overclocked) at 480 Mhz and run the following:

A. Complete AVG scan (with virus definition files updated within 2 hours)
B. Complete Ewido scan (with virus definition files updated within 2 hours)
C. Complete Ad-Aware scan (same on definition files)
D. a "cursory" evaluation of the HJT log, with some repairs made
E. Complete chkdsk scan of the HD
F: Identification and disabling of non-essential programs

4. Reassembly of the box

Not to mention trying to sort out cables from the pile of spaghetti behind the customers computer desk.

The only areas of improvement regarding time that I can see are:

1) I might have been able to extract the HD faster if I had worked with this particular Dell case before. It took me about 20 minutes to finally get the HD out. I might have done it in 5 minutes if I knew exactly how to do it. This is part of the "field experience" I am looking for.

2) I might have limited the AV and malware scans to the select directories I mentioned above.

But I think the assertion that all of this could have been done in an hour is a little bit silly. Perhaps in an hour I might have booted to Safe Mode, diabled the bulk of the bloat, rebooted normally and pronounced it "fixed" (maybe). But I can't say for certain that the AV scans and the chkdsk scan didn't fix something very bad before I booted from the customer's machine.

What if I would have disabled the bloated services, and the machine failed to boot ? Then I'd be in a situation where I have to decide to rely on a slower and possibly sick machine to fix itself, or pull the HD out anyways and run it on my faster and "known good" machine.

Plus, the question of current AV definitions has still gone unanswered.

Possibly I might have been able to access a thumb-drive, or plugged in a USB drive and installed those programs (which takes time), but then how do I access updated definitions ? You can't rely on the sick machine to access the interent. The only other way to do it is to manually download the definitions and store them before you leave for the job. Which takes more time.

Finally, what if the problem was hardware ? Installing a HD that has been vetted and "scrubbed" would tend to draw attention away from it, and toward some other of the customer's hardware, like memory, a malfunctioning CD-RW, heat, inadequate power supply and other suspects. But at least I wouldn't be wondering about the HD, which is a common hardware culprit.

So I'm still asking. I'm not "married" to these opinions and am looking for improvement.

infused

Yes it could have been if you had worked on something like that before. Half that stuff was not nesscary to do ie: ewido scan, ad-aware scan, virus check. Why did you chkdsk the hdds? Why disable the programs?

I still think this job could have been completed in under an hour, here was also no need to remove the drive. Shoving the drive in your own o/c'ed system would not have helped as you are limited by the rpm of the hard drive. All the programs you were running were i/o intensive so I don't really see any purpose of doing that.

I would have downloaded the software for the hard drive, whatever brand it was and booted off a disk using that. Normally a quick test with SMART enabled will tell you if there is anything wrong with the hard drive.

On pricing do the following...

Take all your expenses per month and divide this by 4. So you have to make x amount of money to pay for expenses... but also add petrol, car expenses ($2-3 per job) into the mix as well as these tend to bite later.

Then you can price your self around this... also it would not hurt to call other companies in the area and pretend to be a customer. This is what I did and it really gives you a good indication on what other people in your area are charging.

One thing I would suggest for long jobs like this though is to set a cap. Say to customers our base price is $50 an hour. It may or may not take this long, but it it takes over 3 hours we wont charge you anymore. This reassures the customer at the most they are going to be paying $150.

I think this will make them more willing to use you. This is the problem that I ran into when I first started, I did not outline the pricing correctly and it bit me in the *** later.

You also cannot afford to have your time taken up. So if it starts taking to long, inform the customer that it is going to cost more. Don't be affraid. Most wont have a problem with it, the ones that do, well... it's not worth your time and effort.

yustr

Meztiso,

Here's my opinion on your customer support (since I don't know squat about fixing them I won't comment on your methods): you did your customer a service for which he paid very little.

You did what he wanted. Got his pic's available. Got his internet up and functional. That was what he called you about.

In doing that, you noticed certain other problems (earthlink and symatec being resource hogs) and you suspected potential problems with scum-ware. Don't feel bad about not fixing these. You could have simply pointed them out and suggested he authorize you to make the system work better - for an additional fee!!! Then it becomes his decision if he wants to pay you now or pay you later. It sounds cold but this is a business relationship - it's not your Aunt Betty's computer that you're looking at after a Sunday dinner.

You pointed out why "in-home" service is tough; you can only work on one system at a time. But don't feel bad about sitting there while a necessary program runs - there's nothing you can do about it. You could ask if he wants you to do a quick scan of any other computer he might have there. "No charge, I'm here anyway."

If you search this forum, you'll see that a lot of the guys doing tech support professionally charge by the function: clean virus = $X, purge malware = $Y, etc. You might think about doing that. See what others in your area are charging and beat them.

__________________
I didn't mean to say it. But I meant what I said. J. McMurtry

In Vino Veritas

Meztiso

First thanks, yustr, I appreciate your comments.

Okay, I agree with the HD limit, but if the drive would have remained in the customer's box, the limiting factor would have been the bloat of unknow (probably malware) programs, or at best, the 4 year-old CPU & memory.

I chkdsk'd the HD so I wouldn't wonder if it was HD errors while trouble shooting the system. I ran malware scans for the same reason. I disabled the programs because they were the reason the system was disfunctionally slow, as was proven by the fact that it ran fine once they were disabled.

The fact that you miss this point, and also fail to acknowledge the difficulty in troubleshooting a system infected with malware makes me wonder how much effort you are putting into understanding the situation. That plus you have made objections to virtually everything I did and have not made one constructive statement about what I SHOULD have done. Plus hanging on to what I believe to be an unreasonable belief in an hour's repair time, all cause me to doubt if you either care about my particular situation or possible that you don't know that you are talking about.

Sorry, but that's what it looks like. I'd like you to show me different.

Cellus

Let's work on what can be done instead of what can't, yes? Good, let's hold off on getting worked up about it.

There is an important thing to note in technical support - clients do not care how much effort and ingenuity you put into making their computer habitable again, so long as their Favourites are still there. Yes that's right, their Favourites.

Many clients who hire you may be computer illiterate to some degree. If you start throwing three-letter acronyms at them their eyes will glaze over. Their only care is that the conveniences they had before are available after you are done with their systems. Sometimes it is necessary, especially in cases of malware, for user settings and preferences to be cleared. This does not make them very happy. If you can preserve their settings, do so.

Handy Tip: If it is necessary to make substantial configuration changes to their system, delete things, and so forth use Windows XP's FAST (File And Settings Transfer) Wizard. It can be configured to preserve their Desktop, My Documents, My Pictures, Fonts, file associations, Outlook Express, taskbar options, you name it... Just make sure to be careful in using it if you suspect malware on their system as it would be quite annoying to have everything undone when you import it all back.

You can find the FAST Wizard in System Tools under Accessories.

EDIT: Domain environments can use a version of the FAST Wizard for multiple users called the User State Migration Tool (USMT). It's doubtful you'll ever use it, but it's there.

__________________
TSF Networking Team

HijackThis 5 Step Process
Donate!

NWPhotog

Meztiso

There are several prblems with responses. You are posting to a sub-forum for professional computer repair people and those wanting to be professional. If that isn't your goal you are posting in the wrong place.

1. Charging appropriately for work should be one of your top priorities. Sure it is ok to do a couple for free and then a couple at a discount to get your feet wet. It sounds like you are past that point and continuing to under charge. This is one of the fastest ways to lose respect among your peers. Under charging hurts us all as pros. Enough said.

2. The first step is always to figure out exactly what is going on so you aren't wasting time on what "might" be going on. Removing items from startup, with HJT, and add/remove programs only takes a few minutes and is very worthwhile. Similiarly safe mode and boot CDs are a good way to find out exactly what is going on so you aren't running unneccesary scans.

3. Removing a HD from the case for scans takes time. On a severely infested machine it is a good idea. Doing it onsite is typically not a good idea. It only takes a few minutes to install ewido, adaware, and spybot. It is the actual scans that take time and the CPU isn't going to make enough difference to bother pulling the HD.

You did a lot of things right but enough things wrong to show your inexperience. When asking for advice don't argue with people, take the valuable advice and learn from it. If any of it isn't applicable simply ignore it. All part of being a pro.

infused

I have told you before in another post what I think should have happened... sorry if it is not clear.

Normally if a job takes over one hour or I deem i'm goingt to be taking a computer apart, i'll take it back to the workshop. See if you can gauge the problem before starting any work, I find it much easier to repairs back at my office.

What I would have done is shove in a Disk Checking program specific to the hard drive in question, normally these progs can see if there is an error or not with a quick scan. Then I would have used a Windows PE bootdisk where I could have removed startup items etc right away without waiting for the computer to load its own OS. Personally I would not have delt with the spyware/malware/viruses till later on.

This is where I would have booted into safe mode and done the rest...

I hope this is a more clear than before.

Meztiso

THIS was good advice. Thanks, I'll work on it. Occured to me just now (after the second read) that as a Pro, I will probably need to learn to ignore a LOT of things and stay focused. I guess that applies to activities on this forum as well; keeping in mind what my objective is and not wasting time getting side-tracked on issues that do not move me forward to that objective.

Thanks again,

Mezto