none
Workstation service wont start - error 2

    Question

  • I'm running Windows 2008 server enterprise r2 and I got hit by a nasty virus that modified a bunch of my services and its dependencies.  Since then I'm having a problem getting the workstation service to start.  When I try to start it, it reports:

    Error 2: The system cannot find the file specified.

    I confirmed c:\windows\system32\svchost.exe & wkssvc.dll exist and have the proper dates (they match another 2008 install I have).

    For DependOnService I have:

    Browser, MRxSmb10, MRxSmb20, NSI

    Any suggestions?

     

    Tuesday, November 29, 2011 7:23 PM

Answers

  • Hi,

    Have a try to reinstall Client for Microsoft Networks. It can be found in Properties of Local Area Connection.

    Also compare the key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\LanmanWorkstation with a working system.

     


    TechNet Subscriber Support in forum |If you have any feedback on our support, please contact tnmff@microsoft.com.
    Thursday, December 01, 2011 9:18 AM
    Moderator

All replies

  • Just FYI, this all began after being hit with a nasty trojan Backdoor.ServU.  Just incase anyone comes across it, it installed:

       C:\PROGRAM FILES\Java\jre1.6.0_08\bin\java.exe

       C:\PROGRAM FILES\Java\jre1.6.0_08\bin\java.dll

       C:\PROGRAM FILES\Java\jre1.6.0_08\bin\nio.dll

       C:\PROGRAM FILES\Java\jre1.6.0_08\bin\jsound.dll

       C:\PROGRAM FILES\Java\jre1.6.0_08\bin\jpiexp.dll

       C:\PROGRAM FILES\Java\jre1.6.0_08\bin\npjava13.dll

       C:\PROGRAM FILES\Java\jre1.6.0_08\bin\deploy.dll

    Then....

    -Modifies the service Lanmanworkstation and removes all other dependencies and adds itself as a dependency as “JWS”

    -Modifies the service Lanmanworkserver so that depends on JWS and removes dependencies from lanmanworkserver

    -Modifies Eventlog Service so that it depends on JWS and removes other dependencies

    -Modifies Spooler so that it depends on JWS and remove other dependencies

    -Modifies Dnscache so that it depends on JWS and remove other dependencies

    -Modifies EventSystem so that it depends on JWS and remove other dependencies.

    -Modifies ProtectedStorage so that it depends on JWS and remove other dependencies.

     

    So far I've managed to get all services working again except the Workstation service.  Any suggestions?


    • Proposed as answer by T__16 Tuesday, September 12, 2017 4:00 PM
    Tuesday, November 29, 2011 9:46 PM
  • Hi,

    Have a try to reinstall Client for Microsoft Networks. It can be found in Properties of Local Area Connection.

    Also compare the key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\LanmanWorkstation with a working system.

     


    TechNet Subscriber Support in forum |If you have any feedback on our support, please contact tnmff@microsoft.com.
    Thursday, December 01, 2011 9:18 AM
    Moderator
  • I know this is very old, but I just thought I would mention in case someone else runs into an issue like this....

    I am fairly sure it should be "bowser" not "browser" in that depends registry line...

    eg "bowser/mrxsmb10/mrxsmb20/nsi" - as appropriate

    • Proposed as answer by MQUAL Tuesday, August 15, 2017 1:53 PM
    Monday, December 09, 2013 10:43 AM
  • I know this is getting even older, but after reading around for only "reinstall" solutions Mr. Sugden hit the right spot. I could not see the extra  "r".

    Removed, rebooted. Problem solved.

    Monday, July 10, 2017 2:41 PM
  • The way i resolved this problem was to do the following; 

    Check on Event Log what dependencies is require, for me it was depending on MRxSmb10 

    i then went to control panel> Programs > Uninstall a program > Turn Windows Features On or Off (should be on the left side) 

    then scroll down till you locate SMB 1.0/CIFS File Sharing Support, Untick this click ok > go back to the same place and tick this again Expand and make sure all boxes are ticked, allow it to install > restart PC 

    should be fixed :) 

    Wednesday, December 13, 2017 10:54 AM
  • Dude, why is this a thing!!! Also, thank you. 
    Wednesday, February 07, 2018 12:23 AM
  • Here is my two cents on this and how we put this fix together gathering pieces from everyone.

    WORKSTATION and NETLOGON services not starting caused other services like SQL on another
    server not to start as well as causing GPupdates to fail.

    To fix this issue: go to the registry and find the following registry key --

    • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\LanmanWorkstation
    • On the right - look at DependOnService and make sure you have the following: Bowser MRxSmb20 NSI.
           Note: it should have
           Bowser and "NOT" Browser -- if it has browser then it will break the server after a reboot.
    • After making the change from Browser to Bowser reboot the server.
    • You should be good to go.


    • Edited by FGlez Wednesday, June 13, 2018 3:31 PM
    Wednesday, June 13, 2018 3:18 PM