Who killed my Workstation Service?

February 17, 2007 12:36 PM

What keeps killing Windows Services? I run Windows XP (with SP2) on a MacBook Pro (I know, I know, don't be hatin'). I'm having an odd problem: every now and then, the background for the windows task bar changes, and some of my services get stopped. In particular, Workstation, Wireless Zero Config and Windows Audio are stopped when I check using services.msc.

I'm totally at a loss as to why: I've stripped out extraneous programs, removed all of the non-essential stuff, but still it seems to happen on a random basis. It's bugging the hell out of me, and I'd like to find out what is causing the problem and have a quiet word with it, mafia style. Any ideas?

posted by baggers to Computers & Internet (7 answers total)

That almost sounds like it might be some kind of spyware or an exploit. Does this happen in any particular place or time? Is the machine normally used on a secured network, or is it on the public Internet? Do you run the Windows firewall?

I'm entirely mystified by this one, but maybe that might help narrow it down a little. It really sounds like malicious code... the Workstation service should *never* stop.
posted by Malor at 1:50 PM on February 17, 2007

Try checking the Event log (control panel, administrative tools). Check the tabs there and see if there's anything that mentions the services that are being killed.
posted by Dipsomaniac at 1:59 PM on February 17, 2007

I had the exact same problem last month, and it turned out to be caused by Windows Defender failing on startup (with a cryptic error message, natch). Details here.
posted by backupjesus at 2:31 PM on February 17, 2007

I had the same thing start happening to me last night, and then this morning AVG reported finding two files (generic icon files named setup.exe) with the Trojan horse Proxy.KOR .
posted by jmcgrady at 2:42 PM on February 17, 2007

Response by poster: Malor: It is odd, isn't it? I know that Workstation is pretty damn fundamental. I run this mainly on my home network and at the office, both of which are well secured. I don't run windows firewall, but I do run Antivirus and antispyware (both from Vcom fixit utilities7). This problem predates their installation, tho, so I don't think they are related (I ran AVG before).

Dispomaniac: I've checked that and the problem doesn't seem to generate any error messages. I'll check again when it next happens, tho.

backupjesus: I haven't seen any error messages like yours, but I'll give it a go...
posted by baggers at 11:29 AM on February 18, 2007

Response by poster: Just to update this for anyone having a similar problem: I followed BackupJesus' link and updated Windows Defender. So far (24 hours of heavy use later), the problem has not reoccured, but I'll post again in a few days with a more definitive answer.
posted by baggers at 9:33 AM on February 19, 2007

Response by poster: Sigh. Following up: it's still happening. I've run deep spyware scans, deep AV scans and tried repairing the registry; no joy. And it doesn't seem to produce any errors in the windows events log...
posted by baggers at 2:53 PM on March 4, 2007