Should I block it?

No, this file is 100% safe to run.

VersionsAdditional versions

6.3.9600.16384 (winblue_rtm.130821-1623) 3.66%
6.3.9600.16384 (winblue_rtm.130821-1623) 0.10%
6.3.9431.0 (winmain_bluemp.130615-1214) 0.14%
6.3.9431.0 (winmain_bluemp.130615-1214) 0.05%
6.2.9200.16384 (win8_rtm.120725-1247) 2.42%
6.2.9200.16384 (win8_rtm.120725-1247) 11.83%
6.2.8400.0 (winmain_win8rc.120518-1423) 0.10%
6.2.8400.0 (winmain_win8rc.120518-1423) 0.10%
6.2.8250.0 (winmain_win8beta.120217-1520) 0.05%
6.2.8102.0 (winmain_win8m3.110823-1455) 0.10%
6.1.7600.16385 (win7_rtm.090713-1255) 30.17%
6.1.7600.16385 (win7_rtm.090713-1255) 5.13%
6.1.7600.16385 (win7_rtm.090713-1255) 0.05%
6.1.7600.16385 (win7_rtm.090713-1255) 18.19%
6.1.7600.16385 (win7_rtm.090713-1255) 2.99%
6.0.6000.16386 (vista_rtm.061101-2205) 1.09%
6.0.6000.16386 (vista_rtm.061101-2205) 0.38%
6.0.6000.16386 (vista_rtm.061101-2205) 5.75%
6.0.6000.16386 (vista_rtm.061101-2205) 0.43%
5.2.3790.4530 (srv03_sp2_gdr.090615-1611) 0.05%
5.2.3790.3959 (srv03_sp2_rtm.070216-1710) 0.05%
5.1.2600.5826 (xpsp_sp3_qfe.090609-1445) 1.33%
5.1.2600.5826 (xpsp_sp3_qfe.090609-1445) 0.10%
5.1.2600.5826 (xpsp_sp3_qfe.090609-1445) 0.14%
5.1.2600.5826 (xpsp_sp3_qfe.090609-1445) 0.14%
View more

PE structurePE file structure
Show functions
Import table
advapi32.dll
StartServiceW, SetServiceStatus, I_ScSetServiceBitsW, SystemFunction029, MD5Init, MD5Update, MD5Final, RegQueryValueExW, SystemFunction007, SystemFunction001, RegQueryInfoKeyW, LsaDelete, LsaCreateSecret, LsaQuerySecret, LsaSetSecret, LsaSetInformationPolicy, RegDeleteKeyW, RegCreateKeyExW, CryptAcquireContextW, CryptGenRandom, CryptReleaseContext, LookupAccountSidW, GetSidSubAuthorityCount, GetSidSubAuthority, RegOpenKeyW, LsaOpenSecret, ChangeServiceConfigW, RegNotifyChangeKeyValue, EnumDependentServicesW, ControlService, OpenSCManagerW, OpenServiceW, QueryServiceConfigW, QueryServiceStatus, CloseServiceHandle, RegConnectRegistryW, SetThreadToken, RevertToSelf, OpenThreadToken, RegisterEventSourceW, ReportEventW, DeregisterEventSource, LsaOpenPolicy, ConvertStringSecurityDescriptorToSecurityDescriptorW, LsaQueryInformationPolicy, LsaFreeMemory, LsaClose, RegSetValueExW, RegOpenKeyExW, RegCloseKey, RegisterServiceCtrlHandlerExW
api-ms-win-core-apiquery-l1-1-0.dll
ApiSetQueryApiSetPresence
api-ms-win-core-debug-l1-1-1.dll
OutputDebugStringA
api-ms-win-core-delayload-l1-1-1.dll
ResolveDelayLoadedAPI, DelayLoadFailureHook
api-ms-win-core-errorhandling-l1-1-1.dll
SetLastError, GetLastError, UnhandledExceptionFilter, SetUnhandledExceptionFilter
api-ms-win-core-file-l1-2-0.dll
CreateFileW, DefineDosDeviceW, QueryDosDeviceW
api-ms-win-core-handle-l1-1-0.dll
CloseHandle
api-ms-win-core-heap-l1-2-0.dll
HeapAlloc, HeapFree, GetProcessHeap
api-ms-win-core-heap-obsolete-l1-1-0.dll
LocalReAlloc, LocalAlloc, LocalFree, LocalUnlock, LocalLock
api-ms-win-core-interlocked-l1-2-0.dll
InterlockedExchange, InterlockedCompareExchange, InterlockedDecrement, InterlockedIncrement
api-ms-win-core-io-l1-1-1.dll
CreateIoCompletionPort, GetQueuedCompletionStatus, PostQueuedCompletionStatus
api-ms-win-core-kernel32-legacy-l1-1-0.dll
AddLocalAlternateComputerNameW, DnsHostnameToComputerNameW
api-ms-win-core-kernel32-private-l1-1-0.dll
SetLocalPrimaryComputerNameW, RemoveLocalAlternateComputerNameW, DosPathToSessionPathW, EnumerateLocalComputerNamesW
api-ms-win-core-processthreads-l1-1-1.dll
CreateThread, GetCurrentProcessId, GetCurrentProcess, TerminateProcess, OpenThreadToken, SetThreadToken, GetCurrentThread, GetCurrentThreadId
api-ms-win-core-profile-l1-1-0.dll
QueryPerformanceCounter
api-ms-win-core-registry-l1-1-0.dll
RegCloseKey, RegOpenKeyExW, RegQueryInfoKeyW, RegQueryValueExW, RegSetValueExW, RegNotifyChangeKeyValue
api-ms-win-core-string-obsolete-l1-1-0.dll
lstrcmpW
api-ms-win-core-synch-l1-2-0.dll
EnterCriticalSection, SetEvent, InitializeCriticalSection, LeaveCriticalSection, WaitForSingleObject, ResetEvent, OpenEventW, WaitForMultipleObjectsEx, Sleep, DeleteCriticalSection, CreateEventW
api-ms-win-core-sysinfo-l1-2-0.dll
GetSystemTimeAsFileTime, GetTickCount, SetComputerNameExW, GetVersion, GetLocalTime, GetComputerNameExW, GetVersionExW, GlobalMemoryStatusEx
api-ms-win-core-threadpool-l1-2-0.dll
SetThreadpoolTimer, CreateThreadpoolCleanupGroup, CloseThreadpoolCleanupGroup, WaitForThreadpoolTimerCallbacks, CloseThreadpoolTimer, CloseThreadpoolCleanupGroupMembers, TrySubmitThreadpoolCallback
api-ms-win-eventing-classicprovider-l1-1-0.dll
RegisterTraceGuidsW, GetTraceEnableLevel, GetTraceLoggerHandle, TraceMessage, UnregisterTraceGuids, GetTraceEnableFlags
api-ms-win-eventing-provider-l1-1-0.dll
EventUnregister, EventRegister, EventWrite
api-ms-win-security-activedirectoryclient-l1-1-0.dll
DsBindWithSpnExW, DsMakePasswordCredentialsW, DsCrackNamesW, DsFreeNameResultW, DsUnBindW, DsGetDomainControllerInfoW, DsFreeDomainControllerInfoW, DsFreePasswordCredentials
api-ms-win-security-base-l1-2-0.dll
CheckTokenMembership, CreateWellKnownSid, RevertToSelf
api-ms-win-security-lsalookup-l1-1-1.dll
LsaLookupGetDomainInfo, LsaLookupOpenLocalPolicy, LsaLookupClose, LsaLookupFreeMemory
api-ms-win-service-core-l1-1-0.dll
SetServiceStatus, RegisterServiceCtrlHandlerExW
api-ms-win-service-core-l1-1-1.dll
RegisterServiceCtrlHandlerExW, SetServiceStatus
api-ms-win-service-private-l1-1-0.dll
I_ScSetServiceBitsW
iphlpapi.dll
CancelMibChangeNotify2, GetIfEntry2, NotifyIpInterfaceChange
kernel32.dll
SetLastError, ResetEvent, WaitForSingleObject, DeleteCriticalSection, CloseHandle, InitializeCriticalSection, CreateEventW, LocalFree, lstrcmpW, SetEvent, EnterCriticalSection, GetLastError, LeaveCriticalSection, WaitForMultipleObjects, LocalLock, LocalUnlock, LocalReAlloc, GlobalMemoryStatus, GetVersion, DosPathToSessionPathW, GetLocalTime, RegQueryInfoKeyW, GetComputerNameExW, LocalAlloc, UnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, GetSystemTimeAsFileTime, GetCurrentProcessId, GetCurrentThreadId, GetTickCount, QueryPerformanceCounter, Sleep, LoadLibraryExA, InterlockedCompareExchange, FreeLibrary, GetProcAddress, DelayLoadFailureHook, DnsHostnameToComputerNameW, AddLocalAlternateComputerNameW, RemoveLocalAlternateComputerNameW, SetLocalPrimaryComputerNameW, EnumerateLocalComputerNamesW, GetVersionExW, SetComputerNameExW, InterlockedExchange, HeapFree, HeapAlloc, GetCurrentThread, QueryDosDeviceW, OpenEventW, SetUnhandledExceptionFilter, CreateFileW, DefineDosDeviceW, GlobalFree, LoadLibraryW, GetComputerNameW, GetSystemWindowsDirectoryW, LoadLibraryA, FlushFileBuffers, SetFilePointer, WideCharToMultiByte, GetWindowsDirectoryW, GetFileAttributesW, CreateDirectoryW, GetFileSize, WriteFile, MoveFileExW, ReadFile
msvcrt.dll
DllMain
netapi32.dll
DsGetDcNameWithAccountW, NetApiBufferFree, I_NetListTraverse, I_NetListCanonicalize, I_NetNameCanonicalize, I_NetPathType, NetUnregisterDomainNameChangeNotification, NetRegisterDomainNameChangeNotification, DsRoleGetPrimaryDomainInformation, DsRoleFreeMemory, DsGetDcNameW, NetApiBufferAllocate, NetUserGetInfo, I_NetServerReqChallenge, I_NetServerAuthenticate, NetUseDel, NetUseAdd, Netbios, NetLocalGroupAddMember, NetLocalGroupDelMember, DsEnumerateDomainTrustsW, I_NetNameCompare, I_NetNameValidate, NetUserAdd, NetUserSetInfo, NetpIsRemote, I_NetPathCanonicalize
netjoin.dll
NetpQueryService, NetpCrackNamesStatus2Win32Error, NetpGetMachineAccountName, NetpSeparateUserAndDomain, NetpControlServices, NetpAvoidNetlogonSpnSet, NetSetuppOpenLog, NetSetuppCloseLog, NetpManageIPCConnect, NetpLogPrintHelper, NetpGetListOfJoinableOUs, NetpChangeMachineName, NetpGetJoinInformation, NetpValidateName, NetpGetLsaPrimaryDomain, NetpUnJoinDomain, NetpIsSetupInProgress, NetpGetNewMachineName, NetpDoDomainJoin, NetpMachineValidToJoin
netutils.dll
NetApiBufferAllocate, NetpwPathType, NetpwPathCanonicalize, NetpwNameCanonicalize, NetpwListCanonicalize, NetpwListTraverse, NetApiBufferFree
ntdll.dll
NtCreateEvent, RtlInitializeGenericTable, RtlLookupElementGenericTable, RtlInsertElementGenericTable, RtlEnumerateGenericTable, RtlDeleteElementGenericTable, RtlCompareMemory, RtlInitString, RtlMapSecurityErrorToNtStatus, NtCreateFile, RtlIntegerToUnicodeString, RtlAppendUnicodeStringToString, RtlRunDecodeUnicodeString, RtlRunEncodeUnicodeString, NtQueryVolumeInformationFile, RtlQueryRegistryValues, RtlGetNtProductType, NtOpenThreadToken, NtQueryInformationToken, RtlCompareUnicodeString, NtClose, NtDeviceIoControlFile, NtFsControlFile, RtlInitUnicodeString, NtOpenFile, RtlCopyLuid, RtlAcquireResourceShared, RtlDeleteResource, DbgPrint, RtlInitializeResource, RtlNtStatusToDosError, RtlDeregisterWaitEx, RtlDeregisterWait, RtlAcquireResourceExclusive, RtlReleaseResource, RtlRegisterWait, NtAccessCheckAndAuditAlarm, RtlAdjustPrivilege, RtlCompareMemoryUlong, RtlCopySid, RtlDeleteSecurityObject, RtlLengthSid, RtlSetSaclSecurityDescriptor, RtlSetDaclSecurityDescriptor, RtlSetGroupSecurityDescriptor, RtlSetOwnerSecurityDescriptor, RtlCreateSecurityDescriptor, RtlAddAce, RtlCreateAcl, RtlNewSecurityObject, NtOpenProcessToken, WinSqmIsOptedIn, WinSqmSetDWORD, RtlInitializeSid, RtlSubAuthoritySid, RtlEqualSid, RtlFreeUnicodeString, RtlConvertSidToUnicodeString, RtlFreeOemString, RtlUnicodeStringToOemString, RtlDowncaseUnicodeString, NtQueryInformationProcess, NtQueryLicenseValue, RtlIpv4AddressToStringW, RtlIpv6AddressToStringW, RtlIpv4StringToAddressW, RtlIpv6StringToAddressW, RtlIpv4AddressToStringExW, RtlIpv6AddressToStringExW, RtlQueryRegistryValuesEx
ntdsapi.dll
DsFreeNameResultW, DsMakePasswordCredentialsW, DsBindWithCredW, DsCrackNamesW, DsFreePasswordCredentials, DsUnBindW
rpcrt4.dll
RpcBindingFree, RpcStringBindingParseW, RpcBindingToStringBindingW, RpcBindingServerFromClient, RpcServerRegisterIfEx, RpcServerUseProtseqEpW, RpcServerUnregisterIf, RpcImpersonateClient, RpcRevertToSelf, I_RpcBindingIsClientLocal, NdrServerCall2, RpcStringFreeW, RpcAsyncCompleteCall, RpcServerInqBindings, RpcAsyncAbortCall, NdrClientCall2, NdrAsyncClientCall, I_RpcExceptionFilter, RpcMgmtSetComTimeout, NdrAsyncServerCall, RpcBindingSetAuthInfoExW, RpcMgmtInqServerPrincNameW, RpcEpResolveBinding, RpcBindingFromStringBindingW, RpcStringBindingComposeW, UuidToStringW, UuidCompare, RpcAsyncInitializeHandle, RpcAsyncCancelCall, RpcEpRegisterW, RpcServerUseProtseqW, RpcBindingVectorFree, RpcServerTestCancel, RpcServerUnregisterIfEx, I_RpcMapWin32Status, RpcEpUnregister, RpcServerInqCallAttributesW
samlib.dll
SamCloseHandle, SamSetInformationUser, SamQueryInformationUser, SamOpenUser, SamFreeMemory, SamLookupNamesInDomain, SamOpenDomain, SamConnect
secur32.dll
LsaCallAuthenticationPackage, LsaDeregisterLogonProcess, LsaConnectUntrusted, LsaLookupAuthenticationPackage, LsaFreeReturnBuffer
user32.dll
UnregisterDeviceNotification, RegisterDeviceNotificationW
winbrand.dll
BrandingFormatString
Export table
ServiceMain
SvchostPushServiceGlobals

wkssvc.dll

Workstation Service DLL by Microsoft

Remove wkssvc.dll
Version:   6.2.9200.16384 (win8_rtm.120725-1247)
MD5:   7867cd2cc05d8b1377dc7fee93716015
SHA1:   a0a5050621d9e736b1293af1334be8c0de4d30dd
SHA256:   22546efb97de4ec89a5fdb5fc0779c3dcc9eea885b7340b88c55b25a4cfa5698
This is a Windows system installed file with Windows File Protection (WFP) enabled.

Overview

wkssvc.dll is loaded as dynamic link library that runs in the context of a process. The assembly utilizes the .NET run-time framework (which is required to be installed on the PC). This version is installed on Windows 8.

DetailsDetails

File name:wkssvc.dll
Publisher:Microsoft Corporation
Product name:Workstation Service DLL
Description:Microsoft® Windows® Operating System
Typical file path:C:\Windows\System32\wkssvc.dll
Original name:WKSSVC.DLL.MUI
File version:6.2.9200.16384 (win8_rtm.120725-1247)
Product version:6.2.9200.16384
Size:140.5 KB (143,872 bytes)
Digital DNA
PE subsystem:Windows GUI
File packed:No
Code language:Microsoft Visual C# / Basic .NET
.NET CLR:Yes
.NET NGENed:No
More details

BehaviorsBehaviors

Hosted services
Runs as a shared service under the Windows svcHost
  • Shared name is 'LanmanWorkstation'
  • Shared name is 'LanmanWorkstation'
  • Shared name is 'LanmanWorkstation'
  • Shared name is 'LanmanWorkstation'
  • Shared name is 'LanmanWorkstation'
  • Shared name is 'LanmanWorkstation'
  • Shared name is 'LanmanWorkstation'
  • Shared name is 'LanmanWorkstation'
  • Shared name is 'LanmanWorkstation'
  • Shared name is 'LanmanWorkstation'
  • Shared name is 'LanmanWorkstation'
  • Shared name is 'LanmanWorkstation'
  • Shared name is 'LanmanWorkstation'
  • Shared name is 'LanmanWorkstation'
  • Shared name is 'LanmanWorkstation'
  • Shared name is 'LanmanWorkstation'
  • Shared name is 'LanmanWorkstation'
  • Shared name is 'LanmanWorkstation'
  • Shared name is 'LanmanWorkstation'
  • Shared name is 'LanmanWorkstation'
  • Shared name is 'LanmanWorkstation'
  • Shared name is 'LanmanWorkstation'

Windows OS versionsDistribution by Windows OS

OS versiondistribution
Windows 7 Home Premium 52.00%
Windows 7 Ultimate 28.00%
Windows 7 Professional 10.50%
Windows 7 Home Basic 3.00%
Windows 8 Pro 2.00%
Windows 7 Starter 1.50%
Windows 8 Enterprise Evaluation 0.50%
Windows 7 Enterprise 0.50%
Windows Se7en Titan 0.50%
Windows 8 Pro with Media Center 0.50%
Windows 8 0.50%
Windows Vista Business 0.50%

Distribution by countryDistribution by country

United States installs about 39.90% of Workstation Service DLL.

OEM distributionDistribution by PC manufacturer

PC Manufacturerdistribution
Dell 24.15%
ASUS 14.34%
Hewlett-Packard 13.96%
Acer 13.96%
Toshiba 11.32%
Lenovo 4.53%
Sony 3.77%
Intel 3.02%
GIGABYTE 2.64%
Samsung 2.26%
MSI 1.51%
Alienware 1.13%
Medion 0.75%
Gateway 0.75%
NEC 0.75%
Compaq 0.75%
Sahara 0.38%
Back to top
Should I remove It? Clean your PC of unwanted adware, toolbars and bloatware.

Download it for FREE