When a machine has been infected with malware, most of us here immediately identify the appropriate action as "nuke it from orbit" - i.e. wipe the system and start over. Unfortunately, this is often costly for a company, especially if backups are configured in a less-than-optimal fashion. This can produce resistance from management and users who just want to carry on using the machine for work. After all, as far as they're concerned, they can "just run AV over it" and everything will be fine.

How do you explain the problem to management and users of a non-technical nature? I could easily produce a technical reason, but I'm having trouble coming up with the appropriate wording for non-technical users. I'd especially appreciate any way of speaking that the recipient can identify with, e.g. appealing to a manager's sense of risk management.

In my experience management doesn't like to listen to clever analogies. Depending on the person they care about the bottom line in dollars or hours of productivity. I would explain:


  The actual bottom line is that a compromise of our data will cost the
  company approximately X dollars + Y hours to recover. This is Z%
  likely to happen given the malware that is on this machine. A new
  install will cost A dollars + B hours to recover. You pick the
  appropriate action.


It's short and clear and doesn't really leave them any room to argue. They will clearly understand the risk and should make the right decision. 
