Windows Forum

Ask something
Question Locked

W2k comes up with admin authentication request

0 helpful
11 replies

by oriolus99

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Hi,
If I start my account having broad permissions but no Administrator permission itself, I encounter the following since a short time: an ominous message comes up telling:
"Execute as another user
You are probably not authorized to use all possibilities of 'this program', etc."
And then in essence I am asked to choose between execute 'the program' as Administrator or as an other user (to be filled in).
But it is not told which program wants this authorization. There is nothing else than Outlook in my startup folder.
I don't trust this at all. How can I find out which program wants admin authorization?
TIA, JRE.L

11 replies

by oriolus99

I don't know which 'application' or whatever wants me to let it go by means of a grant by Admin. My question is: how can I find out what application, or whatever, is trying to get its convenience...
If I know that, I can either decide "OK", go ahead, or kick it out of my way, but I just don't know what it is!

by rob miners

open up Task Manager and have a look at Applications and Processes. In Processes check the files with an .exe extension.

by oriolus99

Well, that might point to something strange: exes that appear strange to me:
xphelper (running W2k!), pctsTray, Reader_sl, guard, lsass, csrss, smss.
And if I press OK at the question asked to give Administrator permission, but without giving a correct password, xphelper and Reader_sl disappear from the processes pane. This indeed might give a clue, but for me it stays a riddle...
If I repeat logging in, the request appears again; if I then stop xphelper, the request disappears, but Reader_sl stays running, but after a minute or so, Reader_sl disappears as well.

by ic-it

It seems to be a helper tied to Hitman Pro an alleged anti-malware program that has ties to Spy Sweeper from Webroot. (To me that is enough to condemn it).

by oriolus99

I did run HitmanPro. I do not understand quite what you mean to express. Shouldn't I have done so, I mean running HitmanPro? Would you recommend HijackThis in stead if I suspect to be plagued by malware? If so, what can I do to get rid of the request coming up again and again? I started removing HitmanPro from my pc as Administrator. When starting the removal, only Spybot - Search & Destroy, SpywareBlaster and Software Restriction policy was suggested to be removed in the Options pane. Should I remove Website Blocks and ActiveX kill-bits as well, which are options that are not marked as to be removed?

by oriolus99

Since I seem to have reached the maximum level of talks to and fro, I poke in here to thank you both for your help and also TrueBlue for pointing some direction :).
I'll go through my register after a back-up and see what I can find more, but since I removed most of what HitmanPro left, I think I'll find nothing important anymore.

BTW. Despite these annoying things that came up, I was happy indeed after HitmanPro found the culprit that was far more creepy than this vague and strange thing that after all was not so dreadful, if I understand well.

by pser

Caution edit the registry at your own risk!! Backup before attempting any registry changes.

If you uninstalled a program and the process did NOT remove ALL components, I would remove them as well. Per your question to the other posters.

What may be happening is, something you installed threw an exe for some or all of the app to start when you boot in to Windows (I HATE that!).

HKLM\Software\Microsoft\CurrentVersion\Run is where you'll find some programs that start when you boot in to the OS. Some of it WILL be valid (such as AV stuff) some will just be 'crap' that got installed with the program. You know, QuickTime, Adobe Reader, Real Player, etc. looking for updates, blah, blah, blah. If you can identify what you do and do NOT need then delete the bloat, perhaps you'll find your trouble maker here.

Another thing, you said you have Outlook in your "Startup Folder", perhaps it's trying to authenticate with YOUR credentials as supposed to the 'Admin's or vise versa.

Just a few other things to poke at.

Much Luck!

by ic-it

I dislike any anti-malware program that will do a check but then requires a purchase to remove things (Webroot).
It sounds like Hitman Pro may be cut from the same cloth, if I am understanding your description. It wants to control all the other anti-spyware programs and will even reboot into safe mode with a supplied admin password. Likely it is wanting admin level credentials.

personnally I would remove it completely and run the anti-spyware programs you like on your own.

by rob miners

Glad that I could point you in the right direction. With a bit of help from the others it looks like you are on top of it. :)

This discussion is closed to new replies.