Help making onsite work faster

[jace]

Hello, I was wondering what you guys are using at customer locations to run Virus/adware/spyware scans quickly. Anything out there that scans all user accounts at once ? I'm getting pretty tired of wasting half a day scanning 1 machine with multiple user accounts one account at a time.

thanks for the help

 

[Simmy]

Virus scanners usually scan every file on the hard disk, not just the account files for the user you are logged in as. Plus running 2 or 3 virus/spyware scanners is inevitably going to take along time unfortunately. The quickest virus scanner I've ever used is NOD32.

If a machine is badly infected and needs a few scans , the simplest solution is to take the machine away IMO. There's no guarantee that running all those scans will fix the problem.

 

[Bryce W]

I run ATF Cleaner on a system before I start a virus scan on it. ATF Cleaner cleans out all the temporary files that the virus scanners spend too much time on. This shortens the virus scans alot.

 

[tkrabec]

I have agree with Bryce, get rid of as many files as you can before you do the scan. Then stop as many programs as you can, ie kill IM's. & other Non-essential programs. Also if you've got a machine that is 3+ years old you're going to be there for about an hour. I tend to run a scan, and at the same time run through other settings on the machine, like Hijack this, do a few basic optimizations, etc.

 

[jace]

Thanks

Thanks for the help. How about spyware, adware scanners I know with spybot and ad-aware you have to scan each user account. Anything out there that scans all accounts at once?

 

[gunslinger]

I agree with Simmy that if the system is badly infected I'll just bring it back to the shop with me. If I'm on site I have to charge for the time I'm there even if I'm just watching the screen. If I bring the system back with me I'll only charge for the time I'm actually doing something because I can multi task on a few machines at the same time. I also agree with running a good temp file cleaner first. I use portable Ccleaner, or easy cleaner for this. As for spyware scans, I use a combo of portable Spybot S&D, portable Ad-aware SE, Solo antivirus and Mcafee Stinger.

 

[frostbyte]

I run ATF Cleaner on a system before I start a virus scan on it. ATF Cleaner cleans out all the temporary files that the virus scanners spend too much time on. This shortens the virus scans alot.

That is a very good suggestion. Most people miss this step. I forget myself sometimes. Doing this save a whole lot of time.

 

[Jory]

I would imagine running a virus scan from a boot CD would be much faster than from inside Windows. If you're doing a lot of scanning and fixing of viruses at a customers location it would probably be worth looking into.

 

[Sander]

Removing as much temp files as needed is one step, but what about disabling System Restore. Some virusscanners take ages to scan C:\System Volume Information\_restore ...

 

[gunslinger]

Also don't forget to back up the customers data if the system is badly infected, and scan it before reintroducing it back into the system.

 

[otto]

I can't imagine doing virus removals in home. IF I see a known problematic "tough one" I will remove it manually (or use smitfraudfix) knowing that it won't be removed by all the scans in the world.
At work we use avast / ad-aware / windows defender /and for online scans (safe mode) spywareinfo and bitdefender. We usually run a scan (more than once if infected) until it comes up clean. THEN if the scans didn't remove or damage vital system files and the freshly cleaned pc does boot...will the automatic updates work and so on.
And cleaning out the files...How many times have you seen files that won't delete, access denied and/or administrator restrictions etc. etc. Sometimes unlocker won't work so you have to use something like ERD commander to go in and remove the stubborn ones AND always turn off system restore...
IN OTHER WORDS IT CAN TAKE MORE THAN A DAY and what do you do while waiting for scans to finish?
...It would be quicker to just backup data / reload O.S and put data back on.
I cringe at the thought of in home repair (no matter how hard you try you won't have that 1 tool or part, working with someone over your shoulder and what do you do if they don't want to pay because all you did was plug that wire in or what-ever)...I would have to be like geeksquawk and demand upfront $250 deposit just to set foot in someone elses home.

 

[Jory]

...It would be quicker to just backup data / reload O.S and put data back on.

That's exactly what I do if there is any kind of serious malware infection. Just scan until something is detected, then inform the customer it would be much cheaper for you to take it back to your workbench so you can format and reinstall Windows.

There are just too many threats to keep up with now. Back in the day a major virus/worm would come out and everyone would get infected, and you'd learn the manual removal method for it. You'd get a bunch of calls over a couple week period and all of them were a few minute fix because it was so common. Now with the way malware is so profitable the attacks are too varied and they're evolving so quickly. I found long ago it was less time consuming and much easier just to reinstall the OS.

 

[bishop]

With a badly infected machine I recently started connecting their drive to my notebook with a USB 2.0 IDE/SATA Adapter and selecting their drive to scan. A lot faster.

Very handy if their machine is crawling and the AV and anti-spy software is completely up to date on my lappie. You can backup their data to your HDD too but be sure its a separate partition thats not used. 20GB is usually plenty of room.

 

[iladelf]

While I see the point of scanning a drive via USB on a faster machine, I typically would rather not "crack open" a machine to work on it if I don't have to. Reason? I can just see it now; drive was working but spyware-laced; I remove it, use a USB converter cable or enclosure, and wham-o, suddenly the HDD quits working. Now I've got a really PO'd customer who thinks that I caused their issue, when in reality, who knows what did it.

IMO, I feel better leaving a system intact, rather than playing with the guts inside of it. That's if I don't have to. Otherwise, if the machine isn't running or is on "life-support", then of course, I will open it for diagnosis. But messing with a hard drive that's working? I try to avoid it, if possible.