Workstation - WKSSVC.DLL
Wkssvc.dll is a service provided by Microsoft. It creates and maintains client network connections to remote servers. If this service is stopped, these connections will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start. By default, this service runs as "automatic". Because it has so many dependencies, we'd recommend leaving it that way.

A description of services that run under svchost in Windows XP can be found at http://support.microsoft.com/default.aspx?scid=kb;en-us;314056. A description of default services running under Winodws can be found at http://support.microsoft.com/default.aspx?scid=kb;en-us;Q250320.

Service

Microsoft


Virus Alert – WKSSVC.EXE

Wkssvc.exe and tasksys.exe install with the W32/Dref-E and W32/Dref-G worms. These worms spread via files attached to email or via IRC direct-connect chat (DCC). They can download and install other unwanted programs and can allow a remote user to access your system. This user could download, install, run or delete ifles.

More information on W32/Dref-E can be found at http://www.sophos.com/security/analyses/w32drefe.html.

More information on W32/Dref-G can be found at http://www.sophos.com/security/analyses/w32drefg.html.

We'd recommend removing these files using WinPatrol. First, kill them under Active Tasks then remove them from your Startup Programs. If running WinPatrol 8.x or later; right click each file then select "Delete file on Reboot". Finally, reboot your system.

Virus

Remove