I am a real live tech support person. And I live in Tech Support Hell. SAVE ME!!!! UPDATE: I have been saved!
Wanted: Techs in Support Hell needed to help keep this blog alive!
Clueless Customer: I'm sorry, I am acting stupid.
Me Muted: I'm sure you're not acting.
-- They are never acting stoopid, they are stoopid!
Me: Can you confirm that the thing called Client for Microsoft Networks is not there now?
Clueless Customer: How would I know that?
Me: Is it there now?
Clueless Customer: No
Me: Thank you.
-- Clueless!!!
Me: Is there a firewall on your computer?
Clueless Customer: We put in a password when we want to check our email.
-- That is like answering yes to the question "Do you walk to school or pack a lunch?"
Me: Click on Start then Run
Clueless Customer: On my computer?
-- Is there somewhere else that you have a Start button?
Me: Go to Start > Control Panel
Clueless Customer: Would that be Start > Programs?
-- Is that what I said?
Me: Thank you for calling < ISP . net >, this is Haywood I can help you
Very young voice: pooter not worting
Me: Hi
Very young voice: Hi
Me: Is your mommy there?
-- Turns out she was 3!!! Reminds me of my little one
Completely unrelated to anything computer or even the Internet
Had to steal my car from the auto shop today. Here is the story...
The shop that originally replaced my catalytic converter (due to the exhaust system being all backed up a few months back) used an aftermarket (brand new, but not from the orginal factory) Cat, which should not have been a problem when going to SMOG the beast. Well, it was. It passed everything except for HC (Hydrocarbons) and the shop that replace the exhaust system (Mason's) determined that the Cat was at fault. I didn't have the time needed to replace it yesterday, since they told me about it at 4, and I leave for work @ 4:45 PM... (Yes, that is a very odd time to leave for work. I am well aware...)
So I called them around 4:15 to check if it was done and they said that it was. Nice, I thought... So I pack everything up and head on over there.... I am on foot mind you, since they are only 5 or 6 blocks from my house (at the beach...). Unfortunately, by the time I got there, the shop had closed up its doors for the weekend. I was not about to turn around and walk home and have my wife drive me to work.... That was not an option. Fortunately for me, there were two things working in my favor. 1) The car was parked in front of the shop and 2) I have a spare key stashed in a box that is magnetically connected to the underside of my car.
So essentially, I stole my car today from the shop.... I had to, or else I would not have been able to come into work.... That may actually have been a good thing, now that I think about it....
I tell ya, I have a bunch to say, but by the end of my shift (we are pretty much swamped with calls right now) I am not really motivated to blow off any steam by re-hashing all these calls I took...
Thanks for your recent comments tho! I am seriously considering a way to incorporate forums into this blog... Might require some $$$ to invest in server host since the forums I want to install need php and my personal webspace won't do that....
Here are some links for those of you needing the updates from MS for the Blaster/Nachi patch. In case you are affected by your ISP's filtering of the windowsupdate.com domain name.
Haywood: Standard greeting... Thank you for calling and all that...
Clueless customer: OK
Haywood: So what's going on?
Clueless customer: Nothing
Haywood: So why did you call me?
Just got another one who needed help with UNSUPPORTED hardware!!! Why, oh why, do they call me when they bought something from Fry's and they can no longer boot up their computer??? We provide a highway. We do not help with the car. You don't run to the Dept. of Transportation every time your car breaks... Do you????
Even more disturbing is that Level 1 sent them thru to me! That call should have been stopped at the DOOR! And they left me no notes to track them down with.... grrrrrrr.....
Thanks to those of you who have dropped a comment... I have been swamped lately and will be updating soon... I am feeling rather pissy right now, so it's probably best that I hold off for now...
Symantec recently posted this on their website....
When W32.Welchia.Worm is executed, it performs the following actions:
Copies itself to:
%System%\Wins\Dllhost.exe
NOTE: %System% is a variable. The worm locates the System folder and copies itself to that location. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).
Makes a copy of %System%\Dllcache\Tftpd.exe, as %System%\Wins\svchost.exe.
NOTE: Svchost.exe is a legitimate program, which is not malicious, and therefore Symantec antivirus products will not detect it.
Creates the following services:
Service Name: RpcTftpd
Service Display Name: Network Connections Sharing
Service Binary: %System%\wins\svchost.exe
This service will be set to start manually.
Service Name: RpcPatch
Service Display Name: WINS Client
Service Binary: %System%\wins\dllhost.exe
This service will be set to start automatically.
Ends the process, Msblast, and delete the file %System%\msblast.exe which is dropped by the worm, W32.Blaster.Worm.
The worm will select the victim IP address in two different ways. It will either use A.B.0.0 from the infected machine's IP of A.B.C.D and count up, or it will construct a random IP address based on some hard-coded addresses. After selecting the start address, it will count up through a range of Class C sized networks, for example, if it starts at A.B.0.0, it will count up to at least A.B.255.255.
The worm will send an ICMP echo, or PING, to check if the IP address constructed is an active machine on the network.
Once the worm identifies a machine as being active on the network, it will either send data to TCP port 135, which exploits the DCOM RPC vulnerability, or it will send data to TCP port 80 to exploit the WebDav vulnerability.
Creates a remote shell on the vulnerable host that will connect back to the attacking computer on a random TCP port between 666 and 765 to receive instructions.
Launches the TFTP server on the attacking machine, instructs the victim machine to connect and download Dllhost.exe and Svchost.exe from the attacking machine. If the file, %System%\dllcache\tftpd.exe exists, the worm may not download svchost.exe.
Checks the computer's operating system version, Service Pack number, and System Locale and attempts to connect to Microsoft's Windows Update and download the appropriate DCOM RPC vulnerability patch.
Once the update has been download and executed, the worm will restart the computer so that the patch is installed.
Checks the computer's system date. If the year is 2004, the worm will disable and remove itself.
Note: Haywood recommends that you leave this one on your machine as it looks like it will fix the blaster that you are probably infected with!!
Alternatively, would anyone use a Forum if I put one up? I am envisioning a place to ask tech related questions and have a real live tech support person assist you with the problems... Any takers??
I have been thinking about something for a little while and I know a lot of you out there reading this are working in the same field as me, and I am sure you get similar calls. If there are any other tech support people out there interested in sharing their experiences in this blog, I am willing to open this up to you. Just either post in this thread, or shoot me an email: bloggers @ hawyoodjahelpme dot com, and I will add you to the blog...
It seems a lot of people are finding this blog thru Googling the Error message generated by MS Blast :
Windows must now restart because the remote procedure call RPC service terminated unexpectedly. NT Authority System has initiated the shutdown since the RPC service terminated unexpectedly.
The other day I was showing up near the top of the list... I mean on the first page!!! Pretty fuggin cool I thought.... Here is the permalink. Now I have fallen to the second page... I clicked on my link today and man I can understand why people bail! I gotta get a faster template.... Or remove the comments since no one uses them, and they seem to fail about once a month or so....
In Japan, they have replaced the impersonal and unhelpful Microsoft error messages with Haiku poetry messages. They're used to communicate a timeless message, often achieving a wistful, yearning and powerful
insight through extreme brevity. Here are 16 actual error messages from Japan:
The Web site you seek Cannot be located, but Countless more exist.
Chaos reigns within. Reflect, repent, and reboot. Order shall return.
Program aborting: Close all that you have worked on. You ask far too much.
Windows NT crashed. I am the Blue Screen of Death. No one hears your screams.
Yesterday it worked. Today it is not working. Windows is like that.
Your file was so big. It might be very useful. But now it is gone.
Stay the patient course. Of little worth is your ire. The network is down.
A crash reduces Your expensive computer To a simple stone.
Three things are certain: Death, taxes and lost data. Guess which has occurred.
You step in the stream, But the water has moved on. This page is not here.
Out of memory. We wish to hold the whole sky, But we never will.
Having been erased, The document you're seeking Must now be retyped.
Serious error. All shortcuts have disappeared. Screen. Mind. Both are blank.
Maybe my customers would deal better with Haikus than the traditional errors that the MS Operating System produces... They are just as cryptic, if not more so....
Windows: An unknown error has occured. Internet Explorer will now restart.
Windows: Internet Explorer has performed an illegal operation and will be shut down. If you would like to complain about it, then piss off...
Can you believe it! The also said no further development will be done on the Mac platform's version of IE, as well as no Internet Explorer 7 will be released for Windows as MS plans to integrate the browser into the OS.
That spells doom for tech support. That means we will be supporting the OS, which means we won't be supporting those programs... Hmmm... My job requirements list just got shorter...
Haywood's Manager: We support the settings, not the software...
We are receiving reports on an extraordinarily high number of calls from customers reporting an error that reads along these lines:
Windows must now restart because the remote procedure call RPC service terminated unexpectedly. NT Authority System has initiated the shutdown since the RPC service terminated unexpectedly. We may have a possible solution for these customers, as follows:
* Reset the cable modem
* Upon rebooting, Windows comes up, plans to force a reboot, but the customer has one minute before the reboot takes effect
* During that minute, the customer needs to hit Start/Run and type services. msc and press enter
* This opens a control panel with a list of services
* Double click the listing for the Remote Procedure Call (RPC) item which opens a Dialogue Box (if there are two, select the one that does NOT say Locator next to it)
* In this box are four tabs, choose the Recovery tab
* The Recovery tabs lists three line items, change each line item to Take No Action and hit Apply
* This will stop the reboots
* Do a Ctrl + Alt + Delete, and go to the Task Manager, then click on Processes tab. Find and end the process called msblast.exe.
* Locate the file msblast.exe by searching the hard drive. Delete all versions present (regardess of the file extention, as long as there is a .exe in there somewhere)
* Then advise the customer to visit the Microsoft site for the security patch
* Also advise the customer to update and run their virus scans
Note: Our customers are getting this particular error because of a recent filter implemented to block traffic on port 135. So this worm is trying to use that port to go outbound and is causing errors in RPC for some reason, and the setting in Windows is to REBOOT if that happens!!!! LOL
This was done at the request of the Homeland Security Department to prevent a worm just like this one from spreading. Looks like they got it in just in time... Poor Tier 1 had like 200+ calls on hold at one point tonite.... YIKES!!! And it looks like Microsoft's Windows Update center is being DOSed as a result of this... And it just keeps getting better....
I have noticed that there are quite a few people finding this blog with Google (a wonderful search engine....) Please drop me a note if you find anything that helps you, or if you couldn't find what you were looking for... Also, feel free to search the site with the Google box up above...
Thanks for dropping by! I will try and update a little more frequently if I know people are actually reading this thing....
I have noticed that customers like to make up their own names for various Windows things...
When I hear the phrases "the icon screen" or the "main start screen", or "my start page", I am supposed to KNOW that the customer is refering to what most of us call "the Desktop." I can't see their computer, I have to deduce WTF they are talking about... If we each come up with our own name for it, then that will make everything really confusing, right? So I try to coach my customers to use the "proper" names for things. Doesn't always work... They love to stick by those old familiar names, even tho we (the people who are supposed to help them) have NO IDEA what they are refering to....
Me: What is the error that you are getting?
Mrs. Customer: It says to call you.
Me: It does NOT say to call me...
Mrs. Customer: Where does the other end of this cable go?
Mrs. Customer: Oh, I see...
After she plugged it in, she rightly commented that I should write that one down as one of the stupidest comments I have heard...
Me: Yup
Me: Did Level one give you a ticket number?
Mr. Customer: Huh?? What??
Me: A ticket? Did you talk to another rep?
Mr. Customer: What you talking about?
Me: Never mind. What is your home phone number and I will pull up your account.
Me: Ok, let me know when you see the light come back on on the modem.
Mr. Customer: It's not on now.
Me (with extra emphasis): OK, LET ME KNOW WHEN YOU SEE THAT LIGHT COME BACK ON THE MODEM.
Mr. Customer: OK.
Mrs. Customer: OK.... Are you the conversion department?
Me: ??
Mrs. Customer: She said she had to transfer me to the conversion department.
Me: What are you converting from?
Mrs. Customer: I don't know! She sent me to you!
Me: Did she give you a ticket number?
Mrs. Customer: No!
Me: rolls eyes.... I can help you. What is your home phone number?
Mrs. Customer: xxx - xxx - xxx
After verifying her infomation I figure out that she is one of our customers that is in a system that is converting to use our services instead of the ones of the company that we were previously partnered with (). That being said, Tier 1 should know that there is no such thing here called the Conversion Department...
So once I figured out what I needed to do, it took all of 2 minutes to get her account services converted to the new network.... Her Internet connection was completely unaffected but her email was the thing that she needed to get working.... So we set about fixing it..
Some people are so difficult... I was getting gruff from her the whole time we were talking.... Especially since I was clueless about her comment about the conversion department, she had like NO faith in me...
Me: OK, lets go ahead and set up your email
Mrs. Customer: Now what
Me: Click on Outlook Express
Mrs. Customer: (sigh) Now what
Me: Pausing (giving her back a muted sigh)
Me: Is Outlook Express open?
Mrs. Customer: No
Me: OK, find the little icon that looks like a little envelope and is kinda tannish... Then click on it.
Mrs. Customer: Now what?
Me: Is it open.
Mrs. Customer: Yes. Now what?
Me thinking: I am getting fed up with hearing the same damn question over and over and over again....
So we set her up to get her email for both the old address and the new one and everything was working beautifully yet she couldn't get off the phone with me fast enough...
I tell ya, they just don't appreciate me.... They need to be converted...
Thanks to an alert reader, I have scrubbed the evidence of my employer off a July 18th entry, evidence that was included primarily due to delirium on my part.... Thanks Eric!
That was there for almost a whole month.... I guess work isn't reading my blog :(
What is it about a DOS window that makes people forget their common sense... I ask the lady (or man) to do this:
Me: click on start then run. Now type in "cmd" as in "Charlie", "Michael", "David". That should open a black window.
Mrs. Customer:OK it says C, semi-colon, back slash windows, documents and settings, owner, then a little slashy arrow thing
Me: (the whole time I am biting my tounge as all this info is completely useless to me...)
Me: Go ahead and type in "i-p (pause) c-o-n (pause) f-i-g
Mrs. Customer:Where do I type that?
Me: Right there. Just start typing.
Mrs. Customer:Right here?
Me: Yes, please just start pressing those keys on your keyboard and the letters will appear on your screen (Its amazing how that works, ain't it...)
Mrs. Customer:Ok, now what?
Me: You have it showing ipconfig? Then enter.
Mrs. Customer:There is nothing to click.
Me: Press Enter on your Keyboard.
Mrs. Customer:Oh, ok. It says 'ipcomfig' is not recognized as an internal or external command,
operable program or batch file.
Me: Can you spell that for me?
Mrs. Customer: i-p-c-o-m-f-i-g
Me: M as in Mary? That should be N as in Nancy
It's been interesting now that we are only taking Level 2 calls (I am the guy you get sent to when then first person can't figure out why it isn't working - supported or not). Our call center recently switched over to a full 24/7 support facility. This is good for me because I like the late hours. This is also good for the customer because the other place that used to handle the overnight calls is not as good as we are... :)
Let me give a little background... We tier 2 reps have been taking "overflow" calls to help keep the answer time as low as possible for the customer. Now that we are switching to fully staffed tier 2 24/7, management needs to know what is the real volume of Tier 2 calls. In other words, how many reps do we need, and what shifts do we need covered... That sorta thing...
So, what I find interesting is that 95% of my calls (pure tier 2 calls, that is, there are almost no more password resets these days....) are what I call 169's. Customer cannot obtain an IP address but their computer shows an address of 169.254.x.x.
The dreaded 169
The first thing I check is to see if my software shows the customer's modem as being online. Tonite, they have all been online. Next thing I check is to see if there is anything connected to the modem. I normally see an IP address and a CPE MAC address and a lease time of one day. Tonite I was seeing none of these... All were empty in those fields... Grrr...
So I ask the customer if they are connected directly to the modem. Half of them are like
Random Customer: ? WTF??? Uhm, my computer is on...
Me: And what is the operating system?
Customer: Drops a pin...
Me: What version of Windows are you running?
Customer: Uhm, I have Microsoft Office SP
Me: Office XP? That's great, What version of Windows is this? Windows 98? Windows Millenium?
Customer: Oh, that, its Windows two-thousand Em-EE.
Me: Uhm, is it Windows 2000 or Windows ME?
Customer: Uhm, yes.
However tonite, most were semi intellegent... Yet once we established that there was no router, we ended up doing all sorts of contortions to get them connected and most needed to get a different computer just to get online... Several had problems with the Cat 5 cable connecting the modem to the computer (or router which fed 5 computers in one case... All 5 got knocked offline at the same time... bad ISP connection or bad cat 5? Turned out to be bad Cat 5...)
So, my point is that it seems that the only legitimate calls that are seeping thru the first Tier are the dreaded 169s... It's kinda funny how reps fear these mysterious numbers... Basically, just remember that it indicates a CONNECTION problem more often than not. If you still are pulling a 169 IP address after directly connecting to the cable modem and rebooting everything in order of data flow, then it is either one of 3 things almost all of the time.
1) The cat 5 Cable is bad or has bad connectors. Try switching the ends. Put the end that is in the modem into the computer and put the other end into the modem... This will also ensure a direct connection... ;^)
2) The computer's NIC is bad. You see this a lot with so called on-board Network Cards and putting a new card in often fixes this 169 problem. Sometimes it is a software problem (TCP/IP stack corrupt) but that is much less common than a bad NIC.
3) There is some problem with the modem... This is the least likely but it does happen... Sometimes the Ethernet port on the modem does go bad, but it is not as common as bad cat 5 or a bad NIC. The other thing that happens sometimes is customers accidentally TURN OFF the modem... Some modems have an On/Off switch that does NOT noticably affect the lights on the modem itself...
