Re: [H] AV disabling question

2010-05-26 Thread Thane Sherrington

At 05:24 PM 25/05/2010, Anthony Q. Martin wrote:
No, I don't know a better way...but I have tried myself for 
basically the same reasons. I got the notion that if they were 
easily disabled, then that would represent an attack option by 
viruses trying to get by...don't know if that is true or not.


I think you're right.  It'd be nice if they offered an easy way to 
disable, but I guess then users would be disabling them all the time.


T 





Re: [H] AV disabling question

2010-05-26 Thread Thane Sherrington

At 06:15 PM 25/05/2010, Robert Martin Jr. wrote:
Can't you boot in safe-mode with network support? Also most of the 
BootCD utilities (hirens, etc) have network support and a bootable 
mini-XP to run other windows utilities off USB key or similar.


Safe mode works, but file access is slower, and I'm trying to 
accelerating scan times.


T 





Re: [H] AV disabling question

2010-05-26 Thread Thane Sherrington

At 06:30 PM 25/05/2010, DSinc wrote:

Thane,
I mean no disrespect here, but perhaps you were not as agressive 
w/NOD32 as back 4yrs ago when you scared me into the ESET Oblivion!
I walked away from all things Norton in 1998; I've lived well 
without since. :)


Duncan,
I hate Norton too, but I can't control the clients who come 
into the shop. :)  So I get to see and play with all the AVs.  It's 
great fun. :O


T 





Re: [H] AV disabling question

2010-05-26 Thread Thane Sherrington

At 06:45 PM 25/05/2010, Mesdaq, Ali wrote:
It's probably because there is a TDI or NDIS driver installed as a 
shim between the network driver and the OS being used to filter 
traffic. Turning the service off probably just stops the driver from 
forwarding traffic. It's been a while since I worked on drivers but 
there should be some manual ways to get around this depending on how 
much the AV is watching for modifications. One easy thing you could 
try is stop the services like you did then go to device manager then 
in the view menu select show hidden devices. There should be a new 
list of non-plug and play drivers. You can try to figure out which 
ones are linked to the AV by name then confirm it by opening up the 
driver properties then click on the drivers tab and the driver 
details button. Once you have confirmed it you can stop the driver. 
See if that works. If not then you might need to look at some of the 
tools published by the driver development community that help in 
disabling and unloading drivers.


Thanks Ali, I'll give this a try.

T 





Re: [H] AV disabling question

2010-05-26 Thread Thane Sherrington

At 07:25 PM 25/05/2010, Christopher Fisk wrote:

Yank drive:  Plug in USB HDD converter (I have one that does SATA, 
IDE and Laptop IDE size plug in one) and scan in a known clean 
machine.  That way you can have a known clean system doing the scan 
and won't have to worry that a rootkit is hiding itself.


I do a variant of this myself, but then I do a secondary scan inside 
the actual OS to deal with registry entries and so that programs like 
Malwarebytes will work more reliably (MWB) requires the OS to be live 
to best scanning, according to the writers.)


I've run into virus's recently that usurp winlogon in win.ini as 
well as the explorer.exe shell in the registry.


Oh that happens all the time these days.  I have that fix pretty much 
automated now.


Hell, once recently even replaced the keyboard driver.  Once a 
machine is infected it is faster just to yank the drive and scan it 
externally to a known good machine.


Have you tried using an MD5 hash on the files in the Windows folder 
and subfolders and compared it to a known good hash to try to find 
infections?  I've been playing with that.


I never trust a virus scan run on a machine that is already 
infected.  I do run a Malware scan once I get the machine cleared of 
virus's on another machine to finalize the registry portion of the scan.


You're absolutely right on this.

T 





Re: [H] AV disabling question

2010-05-26 Thread Thane Sherrington

At 11:54 PM 25/05/2010, maccrawj wrote:
Any reason not to just scan with the customer drive attached to a 
bench machine as a data volume  bypass the OS completely? I've come 
to the conclusion that scanning with a host OS of unknown state is 
just not reliable anyway.


Yes, and I do that as well as my first pass.

Imaging the system, a good preventative measure anyway, then 
uninstalling the AV is another idea.


That's an idea - but I'm working on time saving measures here, so 
imaging might add too much time to what I'm doing.


Safemode comes to mind though it disables so much I am not sure it's 
a viable solution.


I do some scanning in safe mode, but I find it's bloody slow.

BTW, on a seperate topic, what do the guys on the list who charge for 
disinfecting computers charge these days to disinfect a machine, and 
about how long is taking you?  I'm charging $47 and it takes about 24 hours.


T 





Re: [H] AV disabling question

2010-05-26 Thread Thane Sherrington

At 11:57 PM 25/05/2010, maccrawj wrote:
Yeah, now that I think about it didn't we all discuss this AV 
scanner machine w/ USB-IDE/SATA converter idea a few years ago?


I've always found the performance hit with USB to be a 
pain.  Possibly with eSATA that would be resolved.


T 





Re: [H] AV disabling question

2010-05-26 Thread Joe User
Hello Thane,

Wednesday, May 26, 2010, 6:36:20 AM, you wrote:


 BTW, on a seperate topic, what do the guys on the list who charge for
 disinfecting computers charge these days to disinfect a machine, and 
 about how long is taking you?  I'm charging $47 and it takes about 24 hours.


I use a clean system to scan infected systems. Yank drive and go.

Takes me about 3 days to a week in real time. Actual time in front of
the system is around 3 hours. Depends on HDD speed, amount of data and
type of data (lots of archives suck). Charge no less then 100.

Check out others around you. Geek Squad charges around 200, IIRC.
My local ISP sends out tech support drones for 120. Not nearly as
thorough - sounds like they are 'recovery disk wizards' mainly.

-- 
Regards,
 joeuser - Still looking for the 'any' key...

...now these points of data make a beautiful line...



Re: [H] AV disabling question

2010-05-26 Thread Christopher Fisk

On Wed, 26 May 2010, Thane Sherrington wrote:

Have you tried using an MD5 hash on the files in the Windows folder and 
subfolders and compared it to a known good hash to try to find infections? 
I've been playing with that.


Nope, so far I've been pretty lucky by sorting by date changed and seeing 
if files show up with modified dates that don't make sense.  Allows a 
quick visual infection scan in the various folders that hold dll, exe and 
sys files.




Christopher Fisk
--
Jayne: Go hwong-tong [Enough of this nonsense].  No trouble now, little 
crazy person...  we're going for a nice shuttle ride...

--Serenity


Re: [H] AV disabling question

2010-05-26 Thread Thane Sherrington

At 09:39 AM 26/05/2010, Christopher Fisk wrote:

On Wed, 26 May 2010, Thane Sherrington wrote:

Have you tried using an MD5 hash on the files in the Windows folder 
and subfolders and compared it to a known good hash to try to find 
infections? I've been playing with that.


Nope, so far I've been pretty lucky by sorting by date changed and 
seeing if files show up with modified dates that don't make 
sense.  Allows a quick visual infection scan in the various folders 
that hold dll, exe and sys files.


That's not a bad idea either.  I should automate something like that 
in my system.


T 





Re: [H] AV disabling question

2010-05-26 Thread Christopher Fisk

On Wed, 26 May 2010, Thane Sherrington wrote:


At 11:54 PM 25/05/2010, maccrawj wrote:
Any reason not to just scan with the customer drive attached to a bench 
machine as a data volume  bypass the OS completely? I've come to the 
conclusion that scanning with a host OS of unknown state is just not 
reliable anyway.


Yes, and I do that as well as my first pass.

Imaging the system, a good preventative measure anyway, then uninstalling 
the AV is another idea.


That's an idea - but I'm working on time saving measures here, so imaging 
might add too much time to what I'm doing.


Imaging is a very good policy.  I don't do it for all my customers, but I 
have been seriously considering starting.  I had a duh! moment earlier 
when I read your message about USB being slow and eSATA being an option. 
Part of the reason we don't image is due to the relative slowness of USB. 
May as well toss an eSATA port in the machine, we have plenty of USB 
enclosures that support eSATA.


http://www.newegg.com/Product/Product.aspx?Item=N82E16817153112

Allows quick plug and unplug of both 3.5 and 2.5 inch drives.  If using 
both drives on the eSATA port your eSATA on your computer needs to support 
port multiplication.



Safemode comes to mind though it disables so much I am not sure it's a 
viable solution.


I do some scanning in safe mode, but I find it's bloody slow.

BTW, on a seperate topic, what do the guys on the list who charge for 
disinfecting computers charge these days to disinfect a machine, and about how 
long is taking you?  I'm charging $47 and it takes about 24 hours.


We service businesses only and charge keyboard time for any cleanups. 
generally $170 for a cleanup for business customers.  We have prior 
relationships for them.  Actual employee time for the cleanup is about 2 
hours, but due to the nature of the cleanups we try to finish within 24 
hours as well.


At $47 you better be getting a lot of volume...

Might want to try to value add to that.  bump the price to $75 and you 
install a free antivirus and zonealarm free, Foxit, 7zip, vlc media 
player, etc.


Always always give them a quote on upgrading their memory if they need 
memory, as we all know it is the cheapest upgrade you can do for an 
immediate speed increase.




Christopher Fisk
--
Jayne: Go hwong-tong [Enough of this nonsense].  No trouble now, little
crazy person...  we're going for a nice shuttle ride...
--Serenity


Re: [H] AV disabling question

2010-05-26 Thread Thane Sherrington

At 09:36 AM 26/05/2010, Joe User wrote:


Takes me about 3 days to a week in real time. Actual time in front of
the system is around 3 hours. Depends on HDD speed, amount of data and
type of data (lots of archives suck). Charge no less then 100.

Check out others around you. Geek Squad charges around 200, IIRC.
My local ISP sends out tech support drones for 120. Not nearly as
thorough - sounds like they are 'recovery disk wizards' mainly.


Yeah, I think I'm way under priced.  I actually had a machine in two 
weeks ago that had been to another small shop, then Staples (both of 
whom had cleaned the computer of infections.)  IE still didn't 
work.  I removed another 57 infections.  Fixed the IE issues 
(hijacked DNS and fake proxy) and had them working.  Clearly I need 
to charge more.


T 





Re: [H] AV disabling question

2010-05-26 Thread Thane Sherrington

At 09:58 AM 26/05/2010, Christopher Fisk wrote:
Imaging is a very good policy.  I don't do it for all my customers, 
but I have been seriously considering starting.  I had a duh! 
moment earlier when I read your message about USB being slow and 
eSATA being an option. Part of the reason we don't image is due to 
the relative slowness of USB. May as well toss an eSATA port in the 
machine, we have plenty of USB enclosures that support eSATA.


http://www.newegg.com/Product/Product.aspx?Item=N82E16817153112

Allows quick plug and unplug of both 3.5 and 2.5 inch drives.  If 
using both drives on the eSATA port your eSATA on your computer 
needs to support port multiplication.


Yeah, with eSATA, I should be able to do imaging as well (at least as 
an upcharge option.)


We service businesses only and charge keyboard time for any 
cleanups. generally $170 for a cleanup for business customers.  We 
have prior relationships for them.  Actual employee time for the 
cleanup is about 2 hours, but due to the nature of the cleanups we 
try to finish within 24 hours as well.


At $47 you better be getting a lot of volume...

Might want to try to value add to that.  bump the price to $75 and 
you install a free antivirus and zonealarm free, Foxit, 7zip, vlc 
media player, etc.


Always always give them a quote on upgrading their memory if they 
need memory, as we all know it is the cheapest upgrade you can do 
for an immediate speed increase.


All good points.  I'm definitely raising prices here.  For $170, what 
do your clients get? (feel free to back channel if you prefer, since 
this is a public list.)


T 





[H] Most annoying Office bug ever (track changes)

2010-05-26 Thread Brian Weeden
This is driving me nuts.  At some point in the last few weeks, my copy of
Word 2007 has decided that every time I open a Word document, it will turn
on track changes and set the view to final.  This is incredibly annoying,
since it means I have to go in and change those settings so I can actually
tell if people made changes or comments in a document.

I've tried deleting my normal word template and completly
uninstalling/reinstalling Office to no avail.  Googling seems to turn out a
lot of stuff about track changes but nothing with regard to this issue.

Any suggestions on how I can fix this before I tear my hair out?

---
Brian Weeden
Technical Advisor
Secure World Foundation http://www.secureworldfoundation.org
+1 (514) 466-2756 Canada
+1 (202) 683-8534 US


Re: [H] AV disabling question

2010-05-26 Thread Christopher Fisk

On Wed, 26 May 2010, Thane Sherrington wrote:

Yeah, with eSATA, I should be able to do imaging as well (at least as an 
upcharge option.)


I do imaging as a CYA for myself, not for the customer.  I can then go 
back to the image and retrieve data if something gets deleted that they 
needed (Some people store crap in the recycle bin and other stupid places)


Always always give them a quote on upgrading their memory if they need 
memory, as we all know it is the cheapest upgrade you can do for an 
immediate speed increase.


All good points.  I'm definitely raising prices here.  For $170, what do your 
clients get? (feel free to back channel if you prefer, since this is a public 
list.)


We don't charge a set price.  $85/hour and we charge however long we are 
at the keyboard of the machine.


First off we clean the virus.  Yank drive, scan, fix TCP/IP as needed, 
etc.


What they get is a machine that has the junk uninstalled.  Dell solution 
Center?  Gone.  Trial versions of NIS, trial version of X, trial version 
of Y, etc. Gone.  Lots of different codec packs installed?  Uninstalled 
and VLC put on machine.


5 different versions of malware removal programs installed?  Gone. 
Install Malwarebytes.  Upgrade Flash Player, Adobe Player, etc.
If it is a personal computer I generally recommend they get rid of 
whatever AV they have, even if they just bought it and have them install 
Avast.  I show them how to do the registration once the year is up.


Windows updates and office updates installed.
PDF Creator installed
Create optimal pagefile.
512MB of memory?  HIGHLY recommend that they upgrade to whatever the max 
their mobo will take, or 4GB if only 32bit OS.
If the machine is used for family photo's I talk to them about picasa.  I 
have not seen a better program for managing your photo's.




One of the most important things I try to do (and this is kinda on the 
sales side) is whenever I point out something I recommend they upgrade I 
also point out something that I think is ok with the system.


If they only have 512MB of memory, I'll recommend that they upgrade the 
system memory to whatever, but at the same time I will say It looks like 
your hard drive is only 50% full (Or whatever) so there is no need to 
upgrade that.


By telling them both what they need and what they don't need people will 
be more inclined to believe you, whereas if you just tell them what they 
should upgrade they are more cynical, thinking you're trying to make them 
spend more money and they're more likely to decline.



Yes, you're trying to get them to spend more, but only because they really 
should get what you're recommending.  Point out the options for free AV, 
etc and they'll see the value you're giving them.




Christopher Fisk
--
You are not my son!
-- Homer Simpson, Boy-Scoutz n the Hood


Re: [H] Most annoying Office bug ever (track changes)

2010-05-26 Thread Christopher Fisk

On Wed, 26 May 2010, Brian Weeden wrote:


This is driving me nuts.  At some point in the last few weeks, my copy of
Word 2007 has decided that every time I open a Word document, it will turn
on track changes and set the view to final.  This is incredibly annoying,
since it means I have to go in and change those settings so I can actually
tell if people made changes or comments in a document.

I've tried deleting my normal word template and completly
uninstalling/reinstalling Office to no avail.  Googling seems to turn out a
lot of stuff about track changes but nothing with regard to this issue.

Any suggestions on how I can fix this before I tear my hair out?


Do you have a roaming profile that could be overwriting the changes you're 
making to the normal.dot?



Christopher Fisk


Re: [H] Most annoying Office bug ever (track changes)

2010-05-26 Thread Brian Weeden
Not that I know of.  When I open a document and it does this, if I go into
the Word Options, Trust Center, and Privacy Settings, the box for make
hidden markup visible when opening or saving is checked.  So somehow Word
is ignoring its own options.

---
Brian Weeden
Technical Advisor
Secure World Foundation http://www.secureworldfoundation.org
+1 (514) 466-2756 Canada
+1 (202) 683-8534 US


On Wed, May 26, 2010 at 2:23 PM, Christopher Fisk chr...@mhonline.netwrote:

 On Wed, 26 May 2010, Brian Weeden wrote:

  This is driving me nuts.  At some point in the last few weeks, my copy of
 Word 2007 has decided that every time I open a Word document, it will turn
 on track changes and set the view to final.  This is incredibly
 annoying,
 since it means I have to go in and change those settings so I can actually
 tell if people made changes or comments in a document.

 I've tried deleting my normal word template and completly
 uninstalling/reinstalling Office to no avail.  Googling seems to turn out
 a
 lot of stuff about track changes but nothing with regard to this issue.

 Any suggestions on how I can fix this before I tear my hair out?


 Do you have a roaming profile that could be overwriting the changes you're
 making to the normal.dot?


 Christopher Fisk



[H] SSE Firefox?

2010-05-26 Thread Thane Sherrington

Ok, this version of Firefox is optimized for SSE?
http://www.binaryturf.com/free-software/blazing-fast-firefox-optimized-distributions/

Has anyone tried this?  Is it actually faster?

T




Re: [H] AV disabling question

2010-05-26 Thread Joe User
Hello Thane,

Wednesday, May 26, 2010, 9:00:01 AM, you wrote:

 Yeah, I think I'm way under priced.  I actually had a machine in two
 weeks ago that had been to another small shop, then Staples (both of 
 whom had cleaned the computer of infections.)  IE still didn't 
 work.  I removed another 57 infections.  Fixed the IE issues 
 (hijacked DNS and fake proxy) and had them working.  Clearly I need 
 to charge more.


People get what they pay for, if they call me and say 'so and so' will
do it for less, I say to them, fine, I will do what 'so and so' does
for the same price and then do a 'so and so' level job and recover it.

So don't just raise your price - just offer more options to keep up
with the scrubs and yet offer that know-how that we have to the people that
understand how to spend money.


-- 
Regards,
 joeuser - Still looking for the 'any' key...

...now these points of data make a beautiful line...



Re: [H] AV disabling question

2010-05-26 Thread Joe User
Hello Thane,

Wednesday, May 26, 2010, 9:01:39 AM, you wrote:


Might want to try to value add to that.  bump the price to $75 and 
you install a free antivirus and zonealarm free, Foxit, 7zip, vlc 
media player, etc.


I would advise against installing any security solutions. I try not to
even offer suggestions. At the end of the day, if you said to use it or
installed it, when it fails... it's YOU that failed. Let them deal
with that or if you must then make sure you qualify that no security
solution is perfect.


-- 
Regards,
 joeuser - Still looking for the 'any' key...

...now these points of data make a beautiful line...



Re: [H] SSE Firefox?

2010-05-26 Thread Scoobydo
I'm pretty sure that AMD and Intel both support SSE and SSE2 extensions so  
what optimization is dude referring to? I'm skeptical there is any speed  
difference that Mozilla hasn't already taken advantage of. Have you  
downloaded and tried for yourself?



On Wed, 26 May 2010 14:41:49 -0500, Thane Sherrington  
th...@computerconnectionltd.com wrote:



Ok, this version of Firefox is optimized for SSE?
http://www.binaryturf.com/free-software/blazing-fast-firefox-optimized-distributions/

Has anyone tried this?  Is it actually faster?

T





--
Using Opera's revolutionary e-mail client: http://www.opera.com/mail/


Re: [H] SSE Firefox?

2010-05-26 Thread Thane Sherrington

At 05:10 PM 26/05/2010, Scoobydo wrote:

I'm pretty sure that AMD and Intel both support SSE and SSE2 extensions so
what optimization is dude referring to? I'm skeptical there is any speed
difference that Mozilla hasn't already taken advantage of. Have you
downloaded and tried for yourself?


I'll put it on a test machine tomorrow and run Peacemaker on it.

T 





Re: [H] Most annoying Office bug ever (track changes)

2010-05-26 Thread FORC5
do u right click and run as administrator ? Maybe  ? Just a thought.
hate word 07
wonder if 10 is any better
fp

At 11:32 AM 5/26/2010, Brian Weeden Poked the stick with:
Not that I know of.  When I open a document and it does this, if I go into
the Word Options, Trust Center, and Privacy Settings, the box for make
hidden markup visible when opening or saving is checked.  So somehow Word
is ignoring its own options.

---
Brian Weeden
Technical Advisor
Secure World Foundation http://www.secureworldfoundation.org
+1 (514) 466-2756 Canada
+1 (202) 683-8534 US


On Wed, May 26, 2010 at 2:23 PM, Christopher Fisk chr...@mhonline.netwrote:

 On Wed, 26 May 2010, Brian Weeden wrote:

  This is driving me nuts.  At some point in the last few weeks, my copy of
 Word 2007 has decided that every time I open a Word document, it will turn
 on track changes and set the view to final.  This is incredibly
 annoying,
 since it means I have to go in and change those settings so I can actually
 tell if people made changes or comments in a document.

 I've tried deleting my normal word template and completly
 uninstalling/reinstalling Office to no avail.  Googling seems to turn out
 a
 lot of stuff about track changes but nothing with regard to this issue.

 Any suggestions on how I can fix this before I tear my hair out?


 Do you have a roaming profile that could be overwriting the changes you're
 making to the normal.dot?


 Christopher Fisk


__ Information from ESET Smart Security, version of virus signature 
database 5148 (20100526) __

The message was checked by ESET Smart Security.

http://www.eset.com

-- 
Tallyho ! ]:8)
Taglines below !
--
Marijuana, nature's way of saying Hi!



Re: [H] AV disabling question

2010-05-26 Thread maccrawj
The Rosewill bridge I have came with it's own PSU  can be attached w/o removing the 
drive, very nice.


I'm writing a powershell script to get file details, launch md5deep to calc the md5, 
and then store the results in CSV file to have a DB for this type of testing. There 
are some degree of checksum databases available from the government sites but they 
lack file details like path, date  version. The most common use for the government 
DB seems to excluding known files from an image for forensics.


Foreign registry .dat's can easily be mounted on a test system, negating the need to 
test on a suspect box IMHO.


On 5/26/2010 4:34 AM, Thane Sherrington wrote:

At 07:25 PM 25/05/2010, Christopher Fisk wrote:


Yank drive: Plug in USB HDD converter (I have one that does SATA, IDE
and Laptop IDE size plug in one) and scan in a known clean machine.
That way you can have a known clean system doing the scan and won't
have to worry that a rootkit is hiding itself.


I do a variant of this myself, but then I do a secondary scan inside the
actual OS to deal with registry entries and so that programs like
Malwarebytes will work more reliably (MWB) requires the OS to be live to
best scanning, according to the writers.)


I've run into virus's recently that usurp winlogon in win.ini as well
as the explorer.exe shell in the registry.


Oh that happens all the time these days. I have that fix pretty much
automated now.


Hell, once recently even replaced the keyboard driver. Once a machine
is infected it is faster just to yank the drive and scan it externally
to a known good machine.


Have you tried using an MD5 hash on the files in the Windows folder and
subfolders and compared it to a known good hash to try to find
infections? I've been playing with that.


I never trust a virus scan run on a machine that is already infected.
I do run a Malware scan once I get the machine cleared of virus's on
another machine to finalize the registry portion of the scan.


You're absolutely right on this.

T




Re: [H] AV disabling question

2010-05-26 Thread maccrawj
Imaging is not so long that I fret it if I can take the box offsite  backup without 
needing compression. Good ass-protector anyways against repairs that break more 
than they fix, LOL!


Likely I'd charge $50 to do a backup/restore of (all) My Documents folder(s) and a 
full OS reinstall+updates assuming I can have the machine offsite for a few days. 
More obviously if I have to stay onsite. It's just not worth the hassle once an 
infection is found to do surgery and not be able to certify there's no undetected 
malware lingering. Added bonus we all know: a reinstalled machine runs faster!


Time wise it's a few hours of hands on and a few more letting updates install. Insult 
to injury, most of the people here are too rural for more than dial up, satellite 
sucks, so bringing a box back to home base where I got 9Mb cable is just more 
expedient.


Now if I could just get enough exposure to get a customer base  show 'em I'm cheaper 
and better than the store front shops + Geek Squad... ;)



On 5/26/2010 4:36 AM, Thane Sherrington wrote:

At 11:54 PM 25/05/2010, maccrawj wrote:

Any reason not to just scan with the customer drive attached to a
bench machine as a data volume  bypass the OS completely? I've come
to the conclusion that scanning with a host OS of unknown state is
just not reliable anyway.


Yes, and I do that as well as my first pass.


Imaging the system, a good preventative measure anyway, then
uninstalling the AV is another idea.


That's an idea - but I'm working on time saving measures here, so
imaging might add too much time to what I'm doing.


Safemode comes to mind though it disables so much I am not sure it's a
viable solution.


I do some scanning in safe mode, but I find it's bloody slow.

BTW, on a seperate topic, what do the guys on the list who charge for
disinfecting computers charge these days to disinfect a machine, and
about how long is taking you? I'm charging $47 and it takes about 24 hours.

T




Re: [H] AV disabling question

2010-05-26 Thread maccrawj

This I can relate to, eSATA would def. be better as would USB 3.0 I think.

On 5/26/2010 4:37 AM, Thane Sherrington wrote:

At 11:57 PM 25/05/2010, maccrawj wrote:

Yeah, now that I think about it didn't we all discuss this AV scanner
machine w/ USB-IDE/SATA converter idea a few years ago?


I've always found the performance hit with USB to be a pain. Possibly
with eSATA that would be resolved.

T




Re: [H] AV disabling question

2010-05-26 Thread maccrawj
This is my understanding also. GS has a flat rate for onsite plus they charge to 
backup, never mind restore, your data. Haven't looked recently but GS had their rates 
spelled out on their site last time I checked.


On 5/26/2010 5:36 AM, Joe User wrote:


Check out others around you. Geek Squad charges around 200, IIRC.
My local ISP sends out tech support drones for 120. Not nearly as
thorough - sounds like they are 'recovery disk wizards' mainly.



Re: [H] AV disabling question

2010-05-26 Thread maccrawj
Those plug 'n go's do the job if you're gonna pull, still I rather own something I 
can use myself when not working:


http://www.newegg.com/Product/Product.aspx?Item=N82E16817198003

Mine came with second tray for free so if forced to, I use it for repairs.

Still amazes me how ATX cheap cases are and how expensive dumb multi-bay drive 
enclosures are never mind the smart stuff like Drobo.



On 5/26/2010 5:58 AM, Christopher Fisk wrote:

On Wed, 26 May 2010, Thane Sherrington wrote:


At 11:54 PM 25/05/2010, maccrawj wrote:

Any reason not to just scan with the customer drive attached to a
bench machine as a data volume  bypass the OS completely? I've come
to the conclusion that scanning with a host OS of unknown state is
just not reliable anyway.


Yes, and I do that as well as my first pass.


Imaging the system, a good preventative measure anyway, then
uninstalling the AV is another idea.


That's an idea - but I'm working on time saving measures here, so
imaging might add too much time to what I'm doing.


Imaging is a very good policy. I don't do it for all my customers, but I
have been seriously considering starting. I had a duh! moment earlier
when I read your message about USB being slow and eSATA being an option.
Part of the reason we don't image is due to the relative slowness of
USB. May as well toss an eSATA port in the machine, we have plenty of
USB enclosures that support eSATA.

http://www.newegg.com/Product/Product.aspx?Item=N82E16817153112

Allows quick plug and unplug of both 3.5 and 2.5 inch drives. If using
both drives on the eSATA port your eSATA on your computer needs to
support port multiplication.



Safemode comes to mind though it disables so much I am not sure it's
a viable solution.


I do some scanning in safe mode, but I find it's bloody slow.

BTW, on a seperate topic, what do the guys on the list who charge for
disinfecting computers charge these days to disinfect a machine, and
about how long is taking you? I'm charging $47 and it takes about 24
hours.


We service businesses only and charge keyboard time for any cleanups.
generally $170 for a cleanup for business customers. We have prior
relationships for them. Actual employee time for the cleanup is about 2
hours, but due to the nature of the cleanups we try to finish within 24
hours as well.

At $47 you better be getting a lot of volume...

Might want to try to value add to that. bump the price to $75 and you
install a free antivirus and zonealarm free, Foxit, 7zip, vlc media
player, etc.

Always always give them a quote on upgrading their memory if they need
memory, as we all know it is the cheapest upgrade you can do for an
immediate speed increase.



Christopher Fisk


[H] Catalyst 10.5 released today..

2010-05-26 Thread Scoobydo

Grab em while their hot..



--
Using Opera's revolutionary e-mail client: http://www.opera.com/mail/


Re: [H] AV disabling question

2010-05-26 Thread maccrawj
All great services  suggestions, should create customer loyalty. Ha! Meanwhile it 
seems generally customer's will shell out $100's to GS to not even fix a problem but 
tend to hesitate when given the honest offer of truly needed options  upgrades to 
prevent problems from returning or keeping a machine running properly even at a 
cheaper price. The human animal is a paradox! Though once they take the chance to 
trust  you deliver, that's a customer for life from my experience.


Good AV that doesn't FORCE paying a fee each year is a rarity that stops me from 
recommending AV solutions in an age when most can get a mediocre one from the ISP for 
free. AVG free had my vote until I figured out how much it affects HDD throughput. 
SAVCE 10.x in the right flavor never enforced the 1yr thing which meant staying 
protected. That outweighs the annual cost to comply with EULA when choosing a product 
since users are notorious for letting subscriptions expire  thinking they are still 
protected but are willing to pay up at some point.


OMG, the 512MB or less to 1GB upgrade is so night  day it's not funny! My sales 
pitch is always is the HDD light on constantly? Bet you a free service call that's 
low RAM! and I never had to give a free on yet. XP leaves  100MB free on a 512MB 
system and swaps near constantly. Do you remember when 24MB was the sweet spot for 9x 
back in the day when systems commonly shipped with 8MB or less? =)


On 5/26/2010 11:22 AM, Christopher Fisk wrote:


One of the most important things I try to do (and this is kinda on the
sales side) is whenever I point out something I recommend they upgrade I
also point out something that I think is ok with the system.

If they only have 512MB of memory, I'll recommend that they upgrade the
system memory to whatever, but at the same time I will say It looks
like your hard drive is only 50% full (Or whatever) so there is no need
to upgrade that.

By telling them both what they need and what they don't need people will
be more inclined to believe you, whereas if you just tell them what they
should upgrade they are more cynical, thinking you're trying to make
them spend more money and they're more likely to decline.


Yes, you're trying to get them to spend more, but only because they
really should get what you're recommending. Point out the options for
free AV, etc and they'll see the value you're giving them.



Re: [H] SSE Firefox?

2010-05-26 Thread maccrawj

Bigger question is will it help with the crushing load of Flash? hehe...




Re: [H] Most annoying Office bug ever (track changes)

2010-05-26 Thread maccrawj

XP was the last not to bloated version IMO.

Assume you do not have the issue with new blank document?

Found this with Google:

That will happen as long as the document contains tracked changes. It's
basically there to protect you--to prevent you from thinking you can send
the document to someone without their being able to see the tracked changes.
The current behavior is based on an earlier Word version (pre-Word 2003, I
think) in which the on/off display of tracked changes was remembered per
document, and people were sending clients changes (sometimes containing
embarrassing comments) without being aware.

So... to keep them from reappearing each time, you'll need to accept or
reject the changes, then turn tracking off.


Herb Tyson MS MVP
Author of the Word 2007 Bible
Blog: http://word2007bible.herbtyson.com
Web: http://www.herbtyson.com;


On 5/26/2010 2:56 PM, FORC5 wrote:

do u right click and run as administrator ? Maybe  ? Just a thought.
hate word 07
wonder if 10 is any better
fp

At 11:32 AM 5/26/2010, Brian Weeden Poked the stick with:

Not that I know of.  When I open a document and it does this, if I go into
the Word Options, Trust Center, and Privacy Settings, the box for make
hidden markup visible when opening or saving is checked.  So somehow Word
is ignoring its own options.

---
Brian Weeden
Technical Advisor
Secure World Foundationhttp://www.secureworldfoundation.org
+1 (514) 466-2756 Canada
+1 (202) 683-8534 US


On Wed, May 26, 2010 at 2:23 PM, Christopher Fiskchr...@mhonline.netwrote:


On Wed, 26 May 2010, Brian Weeden wrote:

  This is driving me nuts.  At some point in the last few weeks, my copy of

Word 2007 has decided that every time I open a Word document, it will turn
on track changes and set the view to final.  This is incredibly
annoying,
since it means I have to go in and change those settings so I can actually
tell if people made changes or comments in a document.

I've tried deleting my normal word template and completly
uninstalling/reinstalling Office to no avail.  Googling seems to turn out
a
lot of stuff about track changes but nothing with regard to this issue.

Any suggestions on how I can fix this before I tear my hair out?



Do you have a roaming profile that could be overwriting the changes you're
making to the normal.dot?


Christopher Fisk



__ Information from ESET Smart Security, version of virus signature 
database 5148 (20100526) __

The message was checked by ESET Smart Security.

http://www.eset.com




Re: [H] Catalyst 10.5 released today..

2010-05-26 Thread maccrawj
Wish they would either restore the disable VPU recover option or at least allow 
some configuration over how it's watchdog senses issues. STALKER:CoP is so flaky and 
never survives a VPU recover.


Thanks for the heads up, downloading to review...


5/26/2010 7:49 PM, Scoobydo wrote:

Grab em while their hot..





Re: [H] Catalyst 10.5 released today..

2010-05-26 Thread Scoobydo

Hope it solves your problem. Stable for me so far..


On Wed, 26 May 2010 22:15:14 -0500, maccrawj maccr...@gmail.com wrote:

Wish they would either restore the disable VPU recover option or at  
least allow some configuration over how it's watchdog senses issues.  
STALKER:CoP is so flaky and never survives a VPU recover.


Thanks for the heads up, downloading to review...


5/26/2010 7:49 PM, Scoobydo wrote:

Grab em while their hot..






--
Using Opera's revolutionary e-mail client: http://www.opera.com/mail/