[BUG] CoworkVMService floods Application event log with 57k+ "Incorrect function" events

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Summary

The CoworkVMService (Claude desktop app background service) floods the Windows
Application event log with thousands of Event ID 1 "Incorrect function" entries.

Details

• Service: CoworkVMService (Display Name: Claude)
• Binary: C:\Program Files\WindowsApps\Claude_1.1.4010.0_x64__pzs8sxrjxfjjc\app\resources\cowork-svc.exe
• Event log: Application, Source: CoworkVMService, Event ID: 1, Level: Information
• Message: "Incorrect function."
• Event data: [Server] Received request: method=isProcessRunning

Impact

57,000+ events generated, making the Application event log unusable for diagnosing
real system issues.

Environment

• Windows 11 Pro 10.0.26200
• Claude desktop app version: 1.1.4010.0
• Confirmed latest version (no update available)

Steps to reproduce

Install Claude desktop app, check Windows Event Viewer → Windows Logs → Application,
filter by Source: CoworkVMService

What Should Happen?

The service should either not log isProcessRunning requests to the Windows
Application event log at all, or handle the "Incorrect function" error
internally without generating an event log entry for each occurrence.
Normal operation should produce zero or near-zero Application log entries.

Error Messages/Logs

Steps to Reproduce

1. Install Claude desktop app (version 1.1.4010.0) on Windows 11
2. Let the app run normally (no special action needed)
3. Open Event Viewer (eventvwr.msc)
4. Navigate to Windows Logs → Application
5. Filter by Source: CoworkVMService
6. Observe thousands of Event ID 1 entries with description

"Incorrect function." and event data
"[Server] Received request: method=isProcessRunning"

Note: 57,000+ events were generated passively over approximately 2 days
of normal use with no user interaction required.

Claude Model

None

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

1.1.4010.0

Platform

Other

Operating System

Windows

Terminal/Shell

Terminal.app (macOS)

Additional Information

_No response_