Windows 7 MS Tech Support

[hlewton]

I have a paid tech support subscription from Microsoft and still had a problem with a file called conime.exe slowing down the opening of my Excel and Access files on occasion. It is not something I can demonstrate at will but I have always managed to clear it up by running Ccleaner’s Registry cleaner and getting rid of the conime entry. I am not going into detail about it here again but just suffice it to say that it does no good to uncheck its startup in any program I have tried. So since this is what I originally paid for that MS support I decided to contact them again and this time got a second level technician who noticed I had too many svhosts running on the Process tab of the task manager so he figured I had malware or rootkit infection. He was remotely attached to my computer and took it over for about 3 hours running at least the programs I have listed below in the safe mode:

Esetsmartinstaller_enu.exe
mbar-1.07.0.1009
mbab-chameleon-1.62.1.1000.zip
RougeKiller.exe
tdsskiller.exe
spybot-2.3.exe
AdwCleaner(1).exe
iExplore.exe

There may have been other programs he ran but those above are what are still resident in my download folder.

Some of these I am familiar with, others not but when I have time will look them up on the NET. In any case what I want to ask here is even though I have no idea yet and won’t possibly for some time if he got rid of the conime problem he did get rid of all instances of svhost appearing in the Task Manager. I don’t know if that is good or bad. What I do know is after I got control of my machine back I could no longer transfer files to attached external hard drives I use on a regular basis with my computer fro backup. I don’t recall the exact dialog box that appeared when trying to copy a file to them but it said something along the lines of access denied - I needed I needed Administrator privileges for that drive. I am the administrator of this computer. I managed to figure out what to do to get my files copied. I had to set the share on the drive and then on the folder I wanted to transfer the file to. I do not recall ever having to do this when I attached and external drive even the first time I attached it. The USB drives I also attach had no problem accepting files as they have always done. So I am wondering what could have happened and if, even though it is working now, the file sharing changes I made was the best solution or if some other solution would have been better especially in light of there may be other external drives in the future.

Thanks

[John Gray]

I assume you mean instances of svchost.exe?

I cannot believe a Microsoft technician terminated all instances of svchost.exe!
Have a read of the How-to Geek's What is svchost.exe And Why Is It Running? for some enlightenment. (Perhaps ring the chap back and point this out to him, too!)

I'd be very tempted to suggest you do a System Restore to a point before he started messing with it... (But await the opinions of others!)

[MalcolmWalker]

I cannot believe a Microsoft technician terminated all instances of svchost.exe!

I don't think he turned off any instances of svchost.exe. More likely he turned off unwanted services that have a dependency on svchost.exe so reducing the number of instances of it running.

[hlewton]

Thank you both for the replies and I really don't think he did anything but run all those programs I listed and maybe some others that I didn't see. The only problem I have encountered is the one I mentioned about not being able to copy files to the attached external hard drives until I messed around with the "share" features. I just don't know why that happened because I don't remember having to ever do that before even on initial use. However, I will try to get back in touch with him but since he has yet to send me the promised email about our remote session it may take a while to do.

[hlewton]

Well I did search the WEB for the programs the MS technician ran or at least I think he ran because they were all downloaded by him to my download folder. I understand most of them and what they do but these 2 are confusing from what I can find - iExplorer.exe and Esetsmartinstaller_enu.exe can be viruses. I found no good definition of what these files are supposed to do. I am assuming they are to remove the files they are named for if they are, in fact viruses. Does this sound correct because Esetsmartinstaller_enu.exe especially sounds like it is going to install the program.

BTW I did try to reach the tech but a second level technician has to be scheduled for a call back by him to me. If I can't get a better idea of what he did I will have to try to schedule that call back but, believe me, it is not an easy task. I have been disconnected more times than I care to think of from the first level help desk and each time I call back I have to start all over with my explanations of why I am calling and trying to reach a second level tech.

[HansV]

ESET is a well-respected developer of security software. Esetsmartinstaller_enu.exe is the installer for their antivirus program.

Are you sure it is iExploreR.exe and not IExplore.exe? IExplore is Internet Explorer, while iExplore has to do with Apple devices...

[hlewton]

ESET is a well-respected developer of security software. Esetsmartinstaller_enu.exe is the installer for their antivirus program.

Are you sure it is iExploreR.exe and not IExplore.exe? IExplore is Internet Explorer, while iExplore has to do with Apple devices...

Hans you're correct it should not have had that "r" on the end. That was a typo. I wonder why he would have run iExplore.exe then. I do have an iTune account but not on this computer.

[HansV]

Perhaps the support technician wanted make sure that you had a clean copy of Internet Explorer.

[hlewton]

Perhaps the support technician wanted make sure that you had a clean copy of Internet Explorer.

I never thought of that but I bet you are correct. Thanks.

[hlewton]

There is only one account on my computer and that is under my name and it is an Administrator account. Ever since having the Microsoft technician work on my computer it has been asking for permission to run certain programs and, like I mentioned above the error message, I got when trying to copy files to attached external hard drives. I have tried to get a call back from the second level technician but so far have had no luck so I decided to try something and want to ask if it was the correct thing to do but so far it seems to have eliminated all the problems I just mentioned. In the "user accounts control settings" I selected the “Never Notify Me” option and rebooted. I tested the programs that were giving me problems running like Revo Uninstaller, Auto Start Program Reviewer, and Search Everything that always worked fine until that technician got a hold of my machine. Anyway is the choice I made a safe one considering that it is an Administrator account that the machine boots up to? I am not at all sure but am guessing that may have been the original setting since all these programs did after initial installation run fine.

[HansV]

I don't mind being asked for permission to run some applications - it seems safer to me than allowing everything to run silently...

[viking33]

I don't mind being asked for permission to run some applications - it seems safer to me than allowing everything to run silently...

Then there is me. I have UAC turned off, right from the initial install of Win 7. Don't like nags!

[hlewton]

I don't mind being asked for permission to run some applications - it seems safer to me than allowing everything to run silently...

I guess my problem is that it was never that way before so I am trying to figure out what changed with the programs that the tech ran.

Then there is me. I have UAC turned off, right from the initial install of Win 7. Don't like nags!

That is my setting now but I just wanted to know if it was safe to set it that way. It seems it is the only setting that allows me to run the programs as I used to be able to do but I'm just not sure if that is how my computer was setup to begin with.

[hlewton]

I been thinking about this and thought since I have no way of knowing what the "user accounts control settings" was set to ahead of the technician working on my machine and since I now set it to the “Never Notify Me” option maybe a better way to ask my question is; is there any other way the programs I mentioned could have opened and run without asking any additional questions with additional dialog boxes like I have them running now? I know I did nothing special when installing them but still I do not know how my computer was set up before.

[HansV]

Could the support technician have changed your account from an administrator account to a restricted one?

[hlewton]

Could the support technician have changed your account from an administrator account to a restricted one?

I was not sure how to tell that but I have looked at the control panel's user accounts and saw only my name listed as the single account on the machine and when looking at that account it says administrator. So I searched the NET to see how to tell and followed these steps:

1. Type the user name and password for your account in the Welcome screen.

2. Open User Accounts by clicking the Start button Picture of the Start button, clicking Control Panel, clicking User Accounts and Family Safety, clicking User Accounts, and then clicking Manage another account. Administrator permission required If you're prompted for an administrator password or confirmation, type the password or provide confirmation.

3.Your account type is displayed below your user name.

4. If your account type is Administrator, then you are currently logged on as an administrator.

5. If your account type is not Administrator, then you cannot log on as an administrator unless you know the user name password for another account on the computer that is an administrator. If you are not an administrator, you can ask an administrator to change your account type. For more information, see Change a user's account type.

Again in Step 4 it showed me as the Administrator and already logged in as one. So I am very confident I do have the Administrator account the same as I always have.

[HansV]

OK, so you're stil Administrator. Perhaps the support technician turned on the UAC warnings as a security measure. But I have no idea why you didn't get prompts before if you didn't turn them off initially - the default is to display the UAC prompt...

[hlewton]

OK, so you're stil Administrator. Perhaps the support technician turned on the UAC warnings as a security measure. But I have no idea why you didn't get prompts before if you didn't turn them off initially - the default is to display the UAC prompt...

You are probably right in that they were turned off before but I don't remember doing it. Perhaps the fellow who builds them for me did that or maybe he told me how to do it but I just don't recall. Is having them turned off the only way I could have been running them in the past without the prompts? If so I tend to agree with you that it may be safer to have them turned on but it is just different than I am used to. Thanks.

[HansV]

As far as I know, setting UAC to 'Never notify' is the only way to turn off the prompts.

[hlewton]

As far as I know, setting UAC to 'Never notify' is the only way to turn off the prompts.

OK thank you. Somehow it got done and I probably did it but I am going to ask the fellow who is even now updating one of my other computers to Win 7. He may have done it but, at least, now I know about it.