powered by Bloglet

Search WWW Search this site

Haywood the Ticket Monkey   Reading blogs at work? Click to escape to a suitable site!

Rate Me on BlogHop.com!   the best pretty good okay pretty bad the worst

home | forums | archives | tools | links

Haywood Jahelpme (aka Tech Support Hell)

I am a real live tech support person. And I live in Tech Support Hell.
SAVE ME!!!! UPDATE: I have been saved!
Wanted: Techs in Support Hell needed to help keep this blog alive!

Saturday, August 30, 2003

.: 3:09 AM
posted by daddy-o

A few random comments to get me caught up

Clueless Customer: I'm sorry, I am acting stupid.
Me Muted: I'm sure you're not acting.
-- They are never acting stoopid, they are stoopid!

Me: Can you confirm that the thing called Client for Microsoft Networks is not there now?
Clueless Customer: How would I know that?
Me: Is it there now?
Clueless Customer: No
Me: Thank you.
-- Clueless!!!

Me: Is there a firewall on your computer?
Clueless Customer: We put in a password when we want to check our email.
-- That is like answering yes to the question "Do you walk to school or pack a lunch?"

Me: Click on Start then Run
Clueless Customer: On my computer?
-- Is there somewhere else that you have a Start button?

Me: Go to Start > Control Panel
Clueless Customer: Would that be Start > Programs?
-- Is that what I said?

Me: Thank you for calling < ISP . net >, this is Haywood I can help you
Very young voice: pooter not worting
Me: Hi
Very young voice: Hi
Me: Is your mommy there?
-- Turns out she was 3!!! Reminds me of my little one

| Ask | Permalink

Friday, August 29, 2003

.: 10:20 PM
posted by daddy-o

Completely unrelated to anything computer or even the Internet

Had to steal my car from the auto shop today. Here is the story...

The shop that originally replaced my catalytic converter (due to the exhaust system being all backed up a few months back) used an aftermarket (brand new, but not from the orginal factory) Cat, which should not have been a problem when going to SMOG the beast. Well, it was. It passed everything except for HC (Hydrocarbons) and the shop that replace the exhaust system (Mason's) determined that the Cat was at fault. I didn't have the time needed to replace it yesterday, since they told me about it at 4, and I leave for work @ 4:45 PM... (Yes, that is a very odd time to leave for work. I am well aware...)

So I called them around 4:15 to check if it was done and they said that it was. Nice, I thought... So I pack everything up and head on over there.... I am on foot mind you, since they are only 5 or 6 blocks from my house (at the beach...). Unfortunately, by the time I got there, the shop had closed up its doors for the weekend. I was not about to turn around and walk home and have my wife drive me to work.... That was not an option. Fortunately for me, there were two things working in my favor. 1) The car was parked in front of the shop and 2) I have a spare key stashed in a box that is magnetically connected to the underside of my car.

So essentially, I stole my car today from the shop.... I had to, or else I would not have been able to come into work.... That may actually have been a good thing, now that I think about it....

| Ask | Permalink

.: 7:44 PM
posted by daddy-o

Not work safe

For those of you out there interested... Blogger boobies

| Ask | Permalink

.: 2:34 AM
posted by daddy-o

I tell ya, I have a bunch to say, but by the end of my shift (we are pretty much swamped with calls right now) I am not really motivated to blow off any steam by re-hashing all these calls I took...

Thanks for your recent comments tho! I am seriously considering a way to incorporate forums into this blog... Might require some $$$ to invest in server host since the forums I want to install need php and my personal webspace won't do that....

| Ask | Permalink

Tuesday, August 26, 2003

.: 2:02 AM
posted by daddy-o

Rampant Illiteracy

Some people are just illiterate. They kill me when they try to GUESS what the words are...

Some of my favorites:

The "LANE" light is on
All I have left is "Windows Lagoon"
I have a "Linsky" cable modem
"CPX 1100U SUB" cable modem

For those of you not in the biz and have no idea WTF I am talking about... Those should have been:

The "LAN" light is on
All I have left is "Windows Logon"
I have a "Linksys" cable modem
"PCX 1100U USB" cable modem

| Ask | Permalink

Sunday, August 24, 2003

.: 6:42 PM
posted by daddy-o

Here are some links for those of you needing the updates from MS for the Blaster/Nachi patch. In case you are affected by your ISP's filtering of the windowsupdate.com domain name.

Win NT (both of you)
Win 2000
Win XP
Win 2003 Server

| Ask | Permalink

Saturday, August 23, 2003

.: 7:31 PM
posted by daddy-o


Haywood: Standard greeting... Thank you for calling and all that...
Clueless customer: OK
Haywood: So what's going on?
Clueless customer: Nothing
Haywood: So why did you call me?

| Ask | Permalink

.: 7:22 PM
posted by daddy-o

A leather Egg

I just updated my Blogger code... Seems I have progressed a bit over the last year:


Old: My blogger code: b1 d++ t k s+ u-- f- i- o x e- l- c-- (decode it!)
New: My blogger code: b5 d++ t k- s u- f- i- o x- e- l- c- (decode it!)

| Ask | Permalink

.: 6:33 PM
posted by daddy-o

Who do you call?

Just got another one who needed help with UNSUPPORTED hardware!!! Why, oh why, do they call me when they bought something from Fry's and they can no longer boot up their computer??? We provide a highway. We do not help with the car. You don't run to the Dept. of Transportation every time your car breaks... Do you????

Even more disturbing is that Level 1 sent them thru to me! That call should have been stopped at the DOOR! And they left me no notes to track them down with.... grrrrrrr.....

/me storms off

| Ask | Permalink

.: 12:39 AM
posted by daddy-o

Thanks to those of you who have dropped a comment... I have been swamped lately and will be updating soon... I am feeling rather pissy right now, so it's probably best that I hold off for now...

| Ask | Permalink

Monday, August 18, 2003

.: 6:42 PM
posted by daddy-o

Is MS trying to fix the blast themselves???

Symantec recently posted this on their website....

When W32.Welchia.Worm is executed, it performs the following actions:

Copies itself to:


NOTE: %System% is a variable. The worm locates the System folder and copies itself to that location. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

Makes a copy of %System%\Dllcache\Tftpd.exe, as %System%\Wins\svchost.exe.

NOTE: Svchost.exe is a legitimate program, which is not malicious, and therefore Symantec antivirus products will not detect it.

Creates the following services:

Service Name: RpcTftpd
Service Display Name: Network Connections Sharing
Service Binary: %System%\wins\svchost.exe

This service will be set to start manually.

Service Name: RpcPatch
Service Display Name: WINS Client
Service Binary: %System%\wins\dllhost.exe

This service will be set to start automatically.

Ends the process, Msblast, and delete the file %System%\msblast.exe which is dropped by the worm, W32.Blaster.Worm.

The worm will select the victim IP address in two different ways. It will either use A.B.0.0 from the infected machine's IP of A.B.C.D and count up, or it will construct a random IP address based on some hard-coded addresses. After selecting the start address, it will count up through a range of Class C sized networks, for example, if it starts at A.B.0.0, it will count up to at least A.B.255.255.

The worm will send an ICMP echo, or PING, to check if the IP address constructed is an active machine on the network.

Once the worm identifies a machine as being active on the network, it will either send data to TCP port 135, which exploits the DCOM RPC vulnerability, or it will send data to TCP port 80 to exploit the WebDav vulnerability.

Creates a remote shell on the vulnerable host that will connect back to the attacking computer on a random TCP port between 666 and 765 to receive instructions.

Launches the TFTP server on the attacking machine, instructs the victim machine to connect and download Dllhost.exe and Svchost.exe from the attacking machine. If the file, %System%\dllcache\tftpd.exe exists, the worm may not download svchost.exe.

Checks the computer's operating system version, Service Pack number, and System Locale and attempts to connect to Microsoft's Windows Update and download the appropriate DCOM RPC vulnerability patch.

Once the update has been download and executed, the worm will restart the computer so that the patch is installed.

Checks the computer's system date. If the year is 2004, the worm will disable and remove itself.

Note: Haywood recommends that you leave this one on your machine as it looks like it will fix the blaster that you are probably infected with!!

[edited for brevity...]

| Ask | Permalink

.: 12:57 AM
posted by daddy-o

A new way to Google

Way to go Google! I love it. I have had it since it was beta and I love the new features....

| Ask | Permalink

.: 12:18 AM
posted by daddy-o

Forums anyone?

Alternatively, would anyone use a Forum if I put one up? I am envisioning a place to ask tech related questions and have a real live tech support person assist you with the problems... Any takers??

| Ask | Permalink

Sunday, August 17, 2003

.: 10:42 PM
posted by daddy-o

Opening up the blog

I have been thinking about something for a little while and I know a lot of you out there reading this are working in the same field as me, and I am sure you get similar calls. If there are any other tech support people out there interested in sharing their experiences in this blog, I am willing to open this up to you. Just either post in this thread, or shoot me an email: bloggers @ hawyoodjahelpme dot com, and I will add you to the blog...

| Ask | Permalink

.: 1:58 AM
posted by daddy-o


It seems a lot of people are finding this blog thru Googling the Error message generated by MS Blast :

Windows must now restart because the remote procedure call RPC service terminated unexpectedly. NT Authority System has initiated the shutdown since the RPC service terminated unexpectedly.

The other day I was showing up near the top of the list... I mean on the first page!!! Pretty fuggin cool I thought.... Here is the permalink. Now I have fallen to the second page... I clicked on my link today and man I can understand why people bail! I gotta get a faster template.... Or remove the comments since no one uses them, and they seem to fail about once a month or so....

| Ask | Permalink

Friday, August 15, 2003

.: 7:26 PM
posted by daddy-o

Error Messages

We all come across them at one time or another... Here are some of the cooler ones that I have seen....

UT Server
Home Star Runner
Weapons of Mass Destruction
The Official 404 research area
Some really good ones grouped by catagory
Some Imperialistic Dogs
Glass Dog
Space Girl
Grateful Fred

And then there is this...

In Japan, they have replaced the impersonal and unhelpful Microsoft error messages with Haiku poetry messages. They're used to communicate a timeless message, often achieving a wistful, yearning and powerful
insight through extreme brevity. Here are 16 actual error messages from Japan:

The Web site you seek Cannot be located, but Countless more exist.

Chaos reigns within. Reflect, repent, and reboot. Order shall return.

Program aborting: Close all that you have worked on. You ask far too much.

Windows NT crashed. I am the Blue Screen of Death. No one hears your screams.

Yesterday it worked. Today it is not working. Windows is like that.

Your file was so big. It might be very useful. But now it is gone.

Stay the patient course. Of little worth is your ire. The network is down.

A crash reduces Your expensive computer To a simple stone.

Three things are certain: Death, taxes and lost data. Guess which has occurred.

You step in the stream, But the water has moved on. This page is not here.

Out of memory. We wish to hold the whole sky, But we never will.

Having been erased, The document you're seeking Must now be retyped.

Serious error. All shortcuts have disappeared. Screen. Mind. Both are blank.

Maybe my customers would deal better with Haikus than the traditional errors that the MS Operating System produces... They are just as cryptic, if not more so....

Windows: An unknown error has occured. Internet Explorer will now restart.
Windows: Internet Explorer has performed an illegal operation and will be shut down. If you would like to complain about it, then piss off...

And here is the Aussie version of Windows...

| Ask | Permalink

.: 1:55 AM
posted by daddy-o

Stevland's Super Fast Computer

Super fast allright and a nice throwback to the days gone by... And a Flash adaptation to keep you from doing any work.

| Ask | Permalink

Thursday, August 14, 2003

.: 2:24 AM
posted by daddy-o

Slashdot | Microsoft Stops Development Of Outlook Express

Can you believe it! The also said no further development will be done on the Mac platform's version of IE, as well as no Internet Explorer 7 will be released for Windows as MS plans to integrate the browser into the OS.

That spells doom for tech support. That means we will be supporting the OS, which means we won't be supporting those programs... Hmmm... My job requirements list just got shorter...

Haywood's Manager: We support the settings, not the software...

| Ask | Permalink

Tuesday, August 12, 2003

.: 6:12 AM
posted by daddy-o

New bug out! Isn't it a blast!!!!

Got this today

We are receiving reports on an extraordinarily high number of calls from customers reporting an error that reads along these lines:
Windows must now restart because the remote procedure call RPC service terminated unexpectedly. NT Authority System has initiated the shutdown since the RPC service terminated unexpectedly.
We may have a possible solution for these customers, as follows:
* Reset the cable modem
* Upon rebooting, Windows comes up, plans to force a reboot, but the customer has one minute before the reboot takes effect
* During that minute, the customer needs to hit Start/Run and type services. msc and press enter
* This opens a control panel with a list of services
* Double click the listing for the Remote Procedure Call (RPC) item which opens a Dialogue Box (if there are two, select the one that does NOT say Locator next to it)
* In this box are four tabs, choose the Recovery tab
* The Recovery tabs lists three line items, change each line item to Take No Action and hit Apply
* This will stop the reboots
* Do a Ctrl + Alt + Delete, and go to the Task Manager, then click on Processes tab. Find and end the process called msblast.exe.
* Locate the file msblast.exe by searching the hard drive. Delete all versions present (regardess of the file extention, as long as there is a .exe in there somewhere)
* Then advise the customer to visit the Microsoft site for the security patch
* Also advise the customer to update and run their virus scans

Note: Our customers are getting this particular error because of a recent filter implemented to block traffic on port 135. So this worm is trying to use that port to go outbound and is causing errors in RPC for some reason, and the setting in Windows is to REBOOT if that happens!!!! LOL

This was done at the request of the Homeland Security Department to prevent a worm just like this one from spreading. Looks like they got it in just in time... Poor Tier 1 had like 200+ calls on hold at one point tonite.... YIKES!!! And it looks like Microsoft's Windows Update center is being DOSed as a result of this... And it just keeps getting better....

Read More from MS

| Ask | Permalink

.: 3:57 AM
posted by daddy-o

How did you find me?

I have noticed that there are quite a few people finding this blog with Google (a wonderful search engine....) Please drop me a note if you find anything that helps you, or if you couldn't find what you were looking for... Also, feel free to search the site with the Google box up above...

Thanks for dropping by! I will try and update a little more frequently if I know people are actually reading this thing....

| Ask | Permalink

.: 3:55 AM
posted by daddy-o

You say Tomato and I say Onion...

I have noticed that customers like to make up their own names for various Windows things...

When I hear the phrases "the icon screen" or the "main start screen", or "my start page", I am supposed to KNOW that the customer is refering to what most of us call "the Desktop." I can't see their computer, I have to deduce WTF they are talking about... If we each come up with our own name for it, then that will make everything really confusing, right? So I try to coach my customers to use the "proper" names for things. Doesn't always work... They love to stick by those old familiar names, even tho we (the people who are supposed to help them) have NO IDEA what they are refering to....

| Ask | Permalink

.: 3:50 AM
posted by daddy-o

A couple quick ones:

Me: What is the error that you are getting?
Mrs. Customer: It says to call you.
Me: It does NOT say to call me...

Mrs. Customer: Where does the other end of this cable go?
Mrs. Customer: Oh, I see...
After she plugged it in, she rightly commented that I should write that one down as one of the stupidest comments I have heard...
Me: Yup

Me: Did Level one give you a ticket number?
Mr. Customer: Huh?? What??
Me: A ticket? Did you talk to another rep?
Mr. Customer: What you talking about?
Me: Never mind. What is your home phone number and I will pull up your account.

Me: Ok, let me know when you see the light come back on on the modem.
Mr. Customer: It's not on now.
Mr. Customer: OK.

| Ask | Permalink

.: 2:35 AM
posted by daddy-o

A new department:

Mrs. Customer: OK.... Are you the conversion department?
Me: ??
Mrs. Customer: She said she had to transfer me to the conversion department.
Me: What are you converting from?
Mrs. Customer: I don't know! She sent me to you!
Me: Did she give you a ticket number?
Mrs. Customer: No!
Me: rolls eyes.... I can help you. What is your home phone number?
Mrs. Customer: xxx - xxx - xxx

After verifying her infomation I figure out that she is one of our customers that is in a system that is converting to use our services instead of the ones of the company that we were previously partnered with (

). That being said, Tier 1 should know that there is no such thing here called the Conversion Department...

So once I figured out what I needed to do, it took all of 2 minutes to get her account services converted to the new network.... Her Internet connection was completely unaffected but her email was the thing that she needed to get working.... So we set about fixing it..

Some people are so difficult... I was getting gruff from her the whole time we were talking.... Especially since I was clueless about her comment about the conversion department, she had like NO faith in me...

Me: OK, lets go ahead and set up your email
Mrs. Customer: Now what
Me: Click on Outlook Express
Mrs. Customer: (sigh) Now what
Me: Pausing (giving her back a muted sigh)
Me: Is Outlook Express open?
Mrs. Customer: No
Me: OK, find the little icon that looks like a little envelope and is kinda tannish... Then click on it.
Mrs. Customer: Now what?
Me: Is it open.
Mrs. Customer: Yes. Now what?
Me thinking: I am getting fed up with hearing the same damn question over and over and over again....

So we set her up to get her email for both the old address and the new one and everything was working beautifully yet she couldn't get off the phone with me fast enough...

I tell ya, they just don't appreciate me.... They need to be converted...

| Ask | Permalink

Monday, August 11, 2003

.: 5:13 PM
posted by daddy-o


Thanks to an alert reader, I have scrubbed the evidence of my employer off a July 18th entry, evidence that was included primarily due to delirium on my part.... Thanks Eric!

That was there for almost a whole month.... I guess work isn't reading my blog :(

/me wipes the sweat off his brow...

| Ask | Permalink

Sunday, August 10, 2003

.: 1:07 AM
posted by daddy-o

What is it about a DOS window that makes people forget their common sense... I ask the lady (or man) to do this:

Me: click on start then run. Now type in "cmd" as in "Charlie", "Michael", "David". That should open a black window.
Mrs. Customer:OK it says C, semi-colon, back slash windows, documents and settings, owner, then a little slashy arrow thing
Me: (the whole time I am biting my tounge as all this info is completely useless to me...)
Me: Go ahead and type in "i-p (pause) c-o-n (pause) f-i-g
Mrs. Customer:Where do I type that?
Me: Right there. Just start typing.
Mrs. Customer:Right here?
Me: Yes, please just start pressing those keys on your keyboard and the letters will appear on your screen (Its amazing how that works, ain't it...)
Mrs. Customer:Ok, now what?
Me: You have it showing ipconfig? Then enter.
Mrs. Customer:There is nothing to click.
Me: Press Enter on your Keyboard.
Mrs. Customer:Oh, ok. It says 'ipcomfig' is not recognized as an internal or external command,
operable program or batch file.
Me: Can you spell that for me?
Mrs. Customer: i-p-c-o-m-f-i-g
Me: M as in Mary? That should be N as in Nancy

| Ask | Permalink

Saturday, August 09, 2003

.: 4:22 AM
posted by daddy-o

How Google works

Ever wonder what makes Google tick? Now we have: Google indicateur - All about the search engine Google

| Ask | Permalink

Wednesday, August 06, 2003

.: 3:53 AM
posted by daddy-o

It's been interesting now that we are only taking Level 2 calls (I am the guy you get sent to when then first person can't figure out why it isn't working - supported or not). Our call center recently switched over to a full 24/7 support facility. This is good for me because I like the late hours. This is also good for the customer because the other place that used to handle the overnight calls is not as good as we are... :)

Let me give a little background... We tier 2 reps have been taking "overflow" calls to help keep the answer time as low as possible for the customer. Now that we are switching to fully staffed tier 2 24/7, management needs to know what is the real volume of Tier 2 calls. In other words, how many reps do we need, and what shifts do we need covered... That sorta thing...

So, what I find interesting is that 95% of my calls (pure tier 2 calls, that is, there are almost no more password resets these days....) are what I call 169's. Customer cannot obtain an IP address but their computer shows an address of 169.254.x.x.

The dreaded 169

The first thing I check is to see if my software shows the customer's modem as being online. Tonite, they have all been online. Next thing I check is to see if there is anything connected to the modem. I normally see an IP address and a CPE MAC address and a lease time of one day. Tonite I was seeing none of these... All were empty in those fields... Grrr...

So I ask the customer if they are connected directly to the modem. Half of them are like

Random Customer: ? WTF??? Uhm, my computer is on...
Me: And what is the operating system?
Customer: Drops a pin...
Me: What version of Windows are you running?
Customer: Uhm, I have Microsoft Office SP
Me: Office XP? That's great, What version of Windows is this? Windows 98? Windows Millenium?
Customer: Oh, that, its Windows two-thousand Em-EE.
Me: Uhm, is it Windows 2000 or Windows ME?
Customer: Uhm, yes.

However tonite, most were semi intellegent... Yet once we established that there was no router, we ended up doing all sorts of contortions to get them connected and most needed to get a different computer just to get online... Several had problems with the Cat 5 cable connecting the modem to the computer (or router which fed 5 computers in one case... All 5 got knocked offline at the same time... bad ISP connection or bad cat 5? Turned out to be bad Cat 5...)

So, my point is that it seems that the only legitimate calls that are seeping thru the first Tier are the dreaded 169s... It's kinda funny how reps fear these mysterious numbers... Basically, just remember that it indicates a CONNECTION problem more often than not. If you still are pulling a 169 IP address after directly connecting to the cable modem and rebooting everything in order of data flow, then it is either one of 3 things almost all of the time.

1) The cat 5 Cable is bad or has bad connectors. Try switching the ends. Put the end that is in the modem into the computer and put the other end into the modem... This will also ensure a direct connection... ;^)

2) The computer's NIC is bad. You see this a lot with so called on-board Network Cards and putting a new card in often fixes this 169 problem. Sometimes it is a software problem (TCP/IP stack corrupt) but that is much less common than a bad NIC.

This is, however, VERY common with XP and 2000, but not so much Win 98... What we are seeing is an error message that says something like "an operation was performed on something that is not a socket." This is often found on computers that have McAfee or Norton installed.

3) There is some problem with the modem... This is the least likely but it does happen... Sometimes the Ethernet port on the modem does go bad, but it is not as common as bad cat 5 or a bad NIC. The other thing that happens sometimes is customers accidentally TURN OFF the modem... Some modems have an On/Off switch that does NOT noticably affect the lights on the modem itself...

Nothing to fear... Bring on the 1-6-9s...

| Ask | Permalink

contact | Why? Why? Why? Watch This! | Projects | Blogroll Me!
Forums | home | archives | ping
B5 d++ t k- s u- f- i- o x- e- l- c-

Search Popdex: