Since updating to 11.2.63.0

[Purpleroses 21]

Since updating to this version  11.2.63.0  noticed that microsoft streaming service proxy vendor microsoft  is trying to access my webcam. I have blocked it but I want to know what is going on.  Should I be blocking this?  Do I have a virus?

I should have mentioned  is is system32\taskhostw.exe which is microsoft streaming service proxy vendor mircosoft trying to access webcam

 

 

Edited September 15, 2018 by Purpleroses

[itman 1,659]

Taskhostw.exe on Win 10 runs as a child process of the Task Scheduler service; i.e. svchost.exe. Normally, it only runs two task objects; Wininit Cache task object and MS Play Sound Service Class on a continuous basis.

If your webcam executable is mysteriously starting execution, it would imply that some existing scheduled task is starting your webcam executable. On the other hand, your webcam process might be set up to start at system startup via a scheduled task. The webcam software installer could have set up the scheduled task when the software was installed.

Edited September 14, 2018 by itman

[Purpleroses 21]

Thank you itman.  This did not happen on previous version.   Just started doing this when I updated to version 11.2.63.0.  It only happens when I shut down my computer and turn it back on.  So should I keep blocking it?

[itman 1,659]

Below is 11.2.63 change log:

Quote

Changelog:

• Fixed: Issues with freezing when debugging applications
• Fixed: Issues with Webcam on Windows 10 RS4/RS5
• Fixed: Issues with background crashes in Anti-Theft
• Fixed: Issues with wi-fi when connected to a public AP

If you're running Win 10 1803, you might want to submit a support ticket since "supposedly" webcam issues were fixed. I don't use a webcam, so can't personally confirm or deny.

Would be nice if Eset elaborated a bit on what "issues" were fixed.

How did you determine this:

Quote

noticed that microsoft streaming service proxy vendor microsoft  is trying to access my webcam

This is a driver with details on it here: https://www.bleepingcomputer.com/startups/MSKSSRV.sys-26056.html . The associated Win service details are here: http://servicedefaults.com/10/mskssrv/ . As noted in the article, the service is set to manual startup. As such, it will only start if some app actually uses it.

Base on the Eset log entires you posted, I see no reference to this service. How did you conclude that this service was accessing your web camera?

The primary question is if taskhostw.exe access to the webcam is suspicious? I would start your investigation by determining is any scheduled task exists that runs your webcam executable and if that is legit activity. Also if its running outside the context of a child process of the Task Scheduler svchost.exe parent process, that would be suspicious. So the next time Eset alerts on this activity, open Task Manager or Process Explorer and see if this is indeed the case.

Edited September 14, 2018 by itman

[Purpleroses 21]

Base on the Eset log entires you posted, I see no reference to this service. How did you conclude that this service was accessing your web camera?

When I look at my logs and click on that it comes up with that service.  I took a screen shot of it

Then I took a screen shot of asking me to block or allow

 

 

 

Edited September 15, 2018 by Purpleroses

[itman 1,659]

At this point, the only thing I can theorize is that streaming service proxy service is being started by taskhostw.exe. This could be normal activity to support the webcam operation. You might want to contact Cyberlink and see if you can get any normal operation details from them in regards to how the webcam operates in regards to Windows processes. Once you have details on how the webcam operates in regards to Windows processes, you can then decide if Eset's alerting is a bug or not.

[KOR 4]

I have been experiencing the same.  Just as you discribe.  KOR-

[itman 1,659]

I will say this.

If your running Win 10 1803, I would say the source of this activity is Skype. Even though I disabled it running in the background, I would periodically see it running in suspended mode. And it was not the only Win app doing this behavior. I finally resorted to blocking all apps from running in the background including Win Store. I now just manually check for Win Store updates.

Try this and see if it stops the Eset alerts. Go into Skype and check what its camera settings are. By default, its set to "on." Set it off and see if the Eset alerting ceases. If so, that leaves the question of why Eset is alerting when Skype starts up. Most likely due to that fact it was Win triggered versus user manual startup?

Edited September 15, 2018 by itman

[KOR 4]

Thank you itman.  Yes, I think Skype is triggering the notice.  Looked for the camera settings but can't find the exact on or off.  I will check again.  KOR-

[itman 1,659]

13 minutes ago, KOR said:

Looked for the camera settings but can't find the exact on or off.  I will check again.

Open up Win 10 apps settings via desktop taskbar "Windows" icon. Then scroll down to Skype. Right click on its icon and then select "Installation settings."

[Nobody2145 0]

1 hour ago, itman said:

I will say this.

If your running Win 10 1803, I would say the source of this activity is Skype.

I agree. Makes no difference in Win 10 1803 if Skype is uninstalled (as in my case). Microsoft apps such as Office 365 still use Skype services. Those Skype services tie themselves to any available webcam and probably any available microphone.

[Purpleroses 21]

I have tried all the suggestions that where given.  I uninstalled skype because I don't use it and I have turned off feedback hub.

But still when I turn on or reboot my laptop I get this pop up.  I have blocked it and there is a rule for it under  advance setup device control webcam rules.  Why would I get the same pop up if it has been already blocked when I restart or shut down my laptop start it again?

Here is the popup I get each time on start up or restart.  It has been blocked access and is in my webcam rules

 

 

Edited September 21, 2018 by Purpleroses

[itman 1,659]

Refer to this thread: https://forum.eset.com/topic/16852-smart-security-premium-webcam-access-notifications/

Appears there is presently no way to prevent Eset web cam notifications for processes where prior rules have been created. You will have to wait until Eset implements a solution such as the one I suggested in that thread.