Purpleroses 21 Posted September 14, 2018 Share Posted September 14, 2018 (edited) Since updating to this version 11.2.63.0 noticed that microsoft streaming service proxy vendor microsoft is trying to access my webcam. I have blocked it but I want to know what is going on. Should I be blocking this? Do I have a virus? I should have mentioned is is system32\taskhostw.exe which is microsoft streaming service proxy vendor mircosoft trying to access webcam Edited September 15, 2018 by Purpleroses Link to comment Share on other sites More sharing options...
itman 1,740 Posted September 14, 2018 Share Posted September 14, 2018 (edited) Taskhostw.exe on Win 10 runs as a child process of the Task Scheduler service; i.e. svchost.exe. Normally, it only runs two task objects; Wininit Cache task object and MS Play Sound Service Class on a continuous basis. If your webcam executable is mysteriously starting execution, it would imply that some existing scheduled task is starting your webcam executable. On the other hand, your webcam process might be set up to start at system startup via a scheduled task. The webcam software installer could have set up the scheduled task when the software was installed. Edited September 14, 2018 by itman Link to comment Share on other sites More sharing options...
Purpleroses 21 Posted September 14, 2018 Author Share Posted September 14, 2018 Thank you itman. This did not happen on previous version. Just started doing this when I updated to version 11.2.63.0. It only happens when I shut down my computer and turn it back on. So should I keep blocking it? Link to comment Share on other sites More sharing options...
itman 1,740 Posted September 14, 2018 Share Posted September 14, 2018 (edited) Below is 11.2.63 change log: Quote Changelog: Fixed: Issues with freezing when debugging applications Fixed: Issues with Webcam on Windows 10 RS4/RS5 Fixed: Issues with background crashes in Anti-Theft Fixed: Issues with wi-fi when connected to a public AP If you're running Win 10 1803, you might want to submit a support ticket since "supposedly" webcam issues were fixed. I don't use a webcam, so can't personally confirm or deny. Would be nice if Eset elaborated a bit on what "issues" were fixed. How did you determine this: Quote noticed that microsoft streaming service proxy vendor microsoft is trying to access my webcam This is a driver with details on it here: https://www.bleepingcomputer.com/startups/MSKSSRV.sys-26056.html . The associated Win service details are here: http://servicedefaults.com/10/mskssrv/ . As noted in the article, the service is set to manual startup. As such, it will only start if some app actually uses it. Base on the Eset log entires you posted, I see no reference to this service. How did you conclude that this service was accessing your web camera? The primary question is if taskhostw.exe access to the webcam is suspicious? I would start your investigation by determining is any scheduled task exists that runs your webcam executable and if that is legit activity. Also if its running outside the context of a child process of the Task Scheduler svchost.exe parent process, that would be suspicious. So the next time Eset alerts on this activity, open Task Manager or Process Explorer and see if this is indeed the case. Edited September 14, 2018 by itman Link to comment Share on other sites More sharing options...
Purpleroses 21 Posted September 14, 2018 Author Share Posted September 14, 2018 (edited) Base on the Eset log entires you posted, I see no reference to this service. How did you conclude that this service was accessing your web camera? When I look at my logs and click on that it comes up with that service. I took a screen shot of it Then I took a screen shot of asking me to block or allow Edited September 15, 2018 by Purpleroses Link to comment Share on other sites More sharing options...
itman 1,740 Posted September 15, 2018 Share Posted September 15, 2018 At this point, the only thing I can theorize is that streaming service proxy service is being started by taskhostw.exe. This could be normal activity to support the webcam operation. You might want to contact Cyberlink and see if you can get any normal operation details from them in regards to how the webcam operates in regards to Windows processes. Once you have details on how the webcam operates in regards to Windows processes, you can then decide if Eset's alerting is a bug or not. Link to comment Share on other sites More sharing options...
KOR 4 Posted September 15, 2018 Share Posted September 15, 2018 I have been experiencing the same. Just as you discribe. KOR- Link to comment Share on other sites More sharing options...
itman 1,740 Posted September 15, 2018 Share Posted September 15, 2018 (edited) I will say this. If your running Win 10 1803, I would say the source of this activity is Skype. Even though I disabled it running in the background, I would periodically see it running in suspended mode. And it was not the only Win app doing this behavior. I finally resorted to blocking all apps from running in the background including Win Store. I now just manually check for Win Store updates. Try this and see if it stops the Eset alerts. Go into Skype and check what its camera settings are. By default, its set to "on." Set it off and see if the Eset alerting ceases. If so, that leaves the question of why Eset is alerting when Skype starts up. Most likely due to that fact it was Win triggered versus user manual startup? Edited September 15, 2018 by itman Link to comment Share on other sites More sharing options...
KOR 4 Posted September 15, 2018 Share Posted September 15, 2018 Thank you itman. Yes, I think Skype is triggering the notice. Looked for the camera settings but can't find the exact on or off. I will check again. KOR- Link to comment Share on other sites More sharing options...
itman 1,740 Posted September 15, 2018 Share Posted September 15, 2018 13 minutes ago, KOR said: Looked for the camera settings but can't find the exact on or off. I will check again. Open up Win 10 apps settings via desktop taskbar "Windows" icon. Then scroll down to Skype. Right click on its icon and then select "Installation settings." Link to comment Share on other sites More sharing options...
Nobody2145 0 Posted September 15, 2018 Share Posted September 15, 2018 1 hour ago, itman said: I will say this. If your running Win 10 1803, I would say the source of this activity is Skype. I agree. Makes no difference in Win 10 1803 if Skype is uninstalled (as in my case). Microsoft apps such as Office 365 still use Skype services. Those Skype services tie themselves to any available webcam and probably any available microphone. Link to comment Share on other sites More sharing options...
Purpleroses 21 Posted September 21, 2018 Author Share Posted September 21, 2018 (edited) I have tried all the suggestions that where given. I uninstalled skype because I don't use it and I have turned off feedback hub. But still when I turn on or reboot my laptop I get this pop up. I have blocked it and there is a rule for it under advance setup device control webcam rules. Why would I get the same pop up if it has been already blocked when I restart or shut down my laptop start it again? Here is the popup I get each time on start up or restart. It has been blocked access and is in my webcam rules Edited September 21, 2018 by Purpleroses Link to comment Share on other sites More sharing options...
itman 1,740 Posted September 21, 2018 Share Posted September 21, 2018 Refer to this thread: https://forum.eset.com/topic/16852-smart-security-premium-webcam-access-notifications/ Appears there is presently no way to prevent Eset web cam notifications for processes where prior rules have been created. You will have to wait until Eset implements a solution such as the one I suggested in that thread. Link to comment Share on other sites More sharing options...
Recommended Posts