Bob Young<p>Sometimes in-person, on site work is better than doing remote maintenance. Story time...</p><p>The owner’s laptop was telling him it needed updates, and he’s not comfortable doing them on mission-critical software. I get it. I hadn’t been on site there in months, so I made arrangements to do the work in person rather than remotely. Last Thursday I was in his office, and I’m glad I was.</p><p>His laptop was ponderously slow on boot-up. I set up that machine a little over a year ago. It’s Windows 11 Pro, modern CPU, lots of RAM. It should be nimble. I called him back into his office and showed him that some of his programs wouldn’t work correctly until after he saw the “black flash” on the screen, which is a custom startup script.</p><p>While we’re watching the boot process, he said, “Can you stop Teams from opening every time I turn on the computer?” I said, “Sure.” Other things were opening, too, so I asked, “Is there anything else opening on startup that you don’t use or want?” He answered, “All of them. Nothing needs to open until I want it.” </p><p>He went on. “Even my browser opens on startup. I don’t know why.” I said, “Okay, you can go do other things for a while, and I’ll get these programs to stop.”</p><p>It turned out that the browser that was opening on startup was one I’ve never heard of, called Shift. Scam Detector rates Shift 42.2 out of a possible 100 points, and labels it “Controversial. Risky. Red Flags.” It looked a lot like any standard browser, but it opened on startup even after I removed its entry from the Startup folder. Also, the name of the entry in the startup folder was “ui,” not Shift. An obfuscated name is sketchy. To make it stop opening on startup I had to open the program and go to its preferences menu.</p><p>All of this made me want to check with the owner. I asked, “Is there a reason you started using the Shift browser?” He looked puzzled and said, “What’s that?” I showed him, and he thought it was just the latest tweaks to Microsoft Edge. He didn’t know how it got there. With his permission I uninstalled it. Between removing several startup apps and uninstalling a browser with suspicious behavior, his computer is back to full speed again.</p><p>THE LESSON<br>On site tech support is an important service offering. Most remote maintenance software doesn’t let you see the boot process, unless you’re working for a company large enough to have something like Dell’s iDRAC solution. Small businesses typically don’t have that. The advantages to on site support include: <br>1. Seeing things you wouldn’t otherwise notice, like boot processes.<br>2. Observing user behavior, which influences a lot of problems.<br>3. Solid relationship building, creating real trust.</p><p><a href="https://infosec.exchange/tags/CallMeIfYouNeedMe" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>CallMeIfYouNeedMe</span></a> <a href="https://infosec.exchange/tags/FIFONetworks" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>FIFONetworks</span></a></p><p><a href="https://infosec.exchange/tags/TechSupport" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>TechSupport</span></a> <a href="https://infosec.exchange/tags/RemoteSupport" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>RemoteSupport</span></a> <a href="https://infosec.exchange/tags/HelpDesk" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>HelpDesk</span></a> <a href="https://infosec.exchange/tags/OnSiteSupport" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>OnSiteSupport</span></a></p>