Is reformatting an acceptable way for a professional to deal with spyware/viruses?

[Siva]

College's high speed internet connections are a virus breeding ground and when people know you can remove virii and spyware in a dorm, you are in trouble. No one wants to reformat because all their schoolwork is right where they want it, blah blah. Taking their computers to computer services takes two days, and two days without AIM ruins one's college social life. So I end up doing the work for my floormates and friends quite often. Its not difficult if you know what you're doing, I have yet to find a virus that I couldn't remove, even with my school's crappy ass virus scanner. If you know what you're doing formatting is never the only option.

 

[DT4K]

At work, the corporate rule is that any computer that gets infected is reformatted. It's the only way to be sure it's clean.

 

[alkemyst]

Originally posted by: DT4K
At work, the corporate rule is that any computer that gets infected is reformatted. It's the only way to be sure it's clean.

'corporate', is a big difference.

Technically if you are corporate, nothing gets saved on the local workstation anyway though, so you just pull the machine, replace it with the same imaged machine, put the old one in the 'GHOST' loop.

If you are running decent policies and AV you should not have corporate infections.

We have a little over 5000 associates and the only viruses are remote site whose '31337' decided to take down the Enterprise firewall and AV to surf the net and download.

This kind of deal gets 'seen', unfortunately most of these 'Bling Blingers' infect themselves too quickly

 

[DT4K]

Originally posted by: alkemyst

Originally posted by: DT4K
At work, the corporate rule is that any computer that gets infected is reformatted. It's the only way to be sure it's clean.

'corporate', is a big difference.

Technically if you are corporate, nothing gets saved on the local workstation anyway though, so you just pull the machine, replace it with the same imaged machine, put the old one in the 'GHOST' loop.

If you are running decent policies and AV you should not have corporate infections.

We have a little over 5000 associates and the only viruses are remote site whose '31337' decided to take down the Enterprise firewall and AV to surf the net and download.

This kind of deal gets 'seen', unfortunately most of these 'Bling Blingers' infect themselves too quickly

We rarely have an issue, but we have been hit a couple times when a new virus came out and definitions hadn't been updated yet. I think we've had maybe 3 or 4 incidents in the 4 years I've been here.

Our fleet of PC's isn't standardized very well. And plenty of people store their work on their own machines here. So it's a little more complicated than just throwing a replacement in. I've got nothing to do with setting policy though. I'm just a dev.

 

[surreal1221]

just reformat. . .

 

[flexy]

ht PROFESSIONAL solution would be this:

You have a DOS bootcd or, better, a Windows PE (pre-install environment, like Windows PE or "Bart's PE builder") which is basically XP running off a bootable CD.
It doesnt even matter what filesystem/OS is on the machine to be cleaned.

From that CD you run your vkiller (mcaffee, fprot, nod) with your definitions and scan the system INDEPENDENTLY of how infected the machine is.

You run your Adaware, spybot etc. from the same Windows PE in addition to cleaning virus.

MORE YOU CANT DO.

If this is not enough and the infection is just too much, system files are infected etc. then the ONLY logical advice is to completely reformat.
THEN you have at least some reasoning behind WHY a reformat - and not a halfa$$ pre-emptive reformat just because you're too lazy or just dont have the "skillz". That's what i'd do.

Edit:
Bart's PE builder - XP off a CD
this is a kicka$$ must have for such tasks !

I am working on making me one with a serious set of tools on it. Viruskillers with latest defs, partitionmagic, etc..etc.
This is so cool it makes me wish i had a job like cleaning/repairing other people's PCs Another "solution" would be Hiren's Boot CD 7.2 - but i won't discuss this further because it's basicaly a warez collection....and DOS w/ NTFS tools is lame compared to a real preinstall environment (like Bart's)...

Just to point out that i would really want to stay away from booting onto a seriuously infected system and work from there - and i am sure the PROs use the PEs too.

 

[Jeff7181]

I'd like to stick the drive in another PC to clean it but the PC is a laptop and I don't have an adapter to connect a 2.5 inch drive to a regular IDE cable.

I worked on it a couple more hours today and I think I have it all cleaned up... I've run Spybot, Adaware, Norton AV, AntiVir, Grisoft, and MS AntiSpyware and none of them detect any threats anymore.

 

[alkemyst]

Originally posted by: flexy
ht PROFESSIONAL solution would be this:

You have a DOS bootcd or, better, a Windows PE (pre-install environment, like Windows PE or "Bart's PE builder") which is basically XP running off a bootable CD.
It doesnt even matter what filesystem/OS is on the machine to be cleaned.

From that CD you run your vkiller (mcaffee, fprot, nod) with your definitions and scan the system INDEPENDENTLY of how infected the machine is.

You run your Adaware, spybot etc. from the same Windows PE in addition to cleaning virus.

MORE YOU CANT DO.

If this is not enough and the infection is just too much, system files are infected etc. then the ONLY logical advice is to completely reformat.
THEN you have at least some reasoning behind WHY a reformat - and not a halfa$$ pre-emptive reformat just because you're too lazy or just dont have the "skillz". That's what i'd do.

Edit:
Bart's PE builder - XP off a CD
this is a kicka$$ must have for such tasks !

I am working on making me one with a serious set of tools on it. Viruskillers with latest defs, partitionmagic, etc..etc.
This is so cool it makes me wish i had a job like cleaning/repairing other people's PCs Another "solution" would be Hiren's Boot CD 7.2 - but i won't discuss this further because it's basicaly a warez collection....and DOS w/ NTFS tools is lame compared to a real preinstall environment (like Bart's)...

Just to point out that i would really want to stay away from booting onto a seriuously infected system and work from there - and i am sure the PROs use the PEs too.

damn and W2k3 too it's now on my USB drive

 

[lokiju]

Not enough money IMO.

 

[Fullmetal Chocobo]

I've wondered about that from time to time. I've always just reformatted when I had issues that couldn't be corrected. It has never been a big deal to me. Keeps things running smoothly also.
Tas.

 

[mobobuff]

I'm not dealing with a retard's spyware for only $15 an hour. I'd back up data and reformat.

 

[alkemyst]

Originally posted by: tasburrfoot78362
I've wondered about that from time to time. I've always just reformatted when I had issues that couldn't be corrected. It has never been a big deal to me. Keeps things running smoothly also.
Tas.

What couldn't be corrected? What do you have installed/personal files lost?

If I have to reinstall, it's a day+ I have a lot of programs and more data...I am actually thinking of a daily backup now.

all the tweaks I have done and forgotten maybe a month. Nothing is worse than using a program and it's just not behaving like before.

I hate rebuilding my machine...it almost kept me from going PIII-S 1.4Ghz@1.5GHz to AMD 64 @ 3800+

I wish I could just re-ghost it like on-site. My problems tend to come from adding hardware though than downloading stuff....SCSI subsystem of 4 opticals, 2 MM readers, and a HP 4C scanner...just had to upgrade my Palm IIIxe due to it conflicting with my Nokia 6230

 

[alkemyst]

Originally posted by: mobobuff
I'm not dealing with a retard's spyware for only $15 an hour. I'd back up data and reformat.

it's very PC of you to admit dealing with those retard's. How do you back up data on a hosed computer though?

I'd be rich with this answer.

 

[imported_ArtVandalay]

It's nigh impossible with a medium-high grade cluserfvck (ie. 90% of the AOLers out there going "OMGZ FREE EMAIL SMILEYZ!!1!!1!111"). Many adware/spyware programs and viruses do pretty much irreparable damage to windows. While you could conceivably burn the midnight oil for a week and actually fully clean a badly infected PC... why? reformatting doesn't take nearly as long.

 

[Diasper]

If the infection is light then there shouldn't be any need to reformat.

However, if infection is especially heavy and things are looking to take far longer to remove by hand than to reformat and reinstall eg 1.5x then I would look to a re-format.

If the PC is set to run any data sensitive/critical tasks then I would consider a reformat outright after backing up and ensuring it the backups are malware free. Often if particularly bad nasties have been on the machine, I wouldn't take the risk of not formatting afterwards particularly as they can make a mess of a machines stability that might take quite a while to correct.

Of course, if the client still wishes to not format you have to listen to them.

 

[Schadenfroh]

Please see Section B of the Consolidated Security Thread .

 

[Eeezee]

I usually reformat once a year just to start fresh anyway. Things run faster for awhile after a reformat. I've never had virus problems or anything like that. I don't understand why so many people have an aversion to a reformat