Support Tool: WPSHelper service failure

Products

• Endpoint Protection

Issue/Introduction

The Symantec Endpoint Protection Support Tool reports an error with WPSHelper.

Resolution

WPSHelper is the kernel level driver component of the Endpoint Protection Client's Intrusion Prevention System (IPS) functionality. WPSHelper is installed in conjunction with the firewall component of Endpoint Protection, listed in the Client Interface as "Network Threat Protection."

If the Support Tool detects a failure, it indicates that there is a problem with the firewall component of the software.

When Endpoint Protection is manually disabled, the services restart after a period of 5 minutes. However, WPSHelper does not automatically restart. If you encounter an error from the Support Tool, restarting the computer rule this out as a possible cause.

There was a known issue with the previous version of the IPS engine (build: 12.0.0.41), this issue would manifest itself when attempting to stop the Wpshelper driver. In order to correct this issue, an updated version of WPShelper was released via Liveupdate on March 29th 2009, this new build number is 12.0.1.41. The new WPShelper Driver contains a fix for a crash that was occurring when trying to stop the WpsHelper driver and will be released via LiveUpdate to all SEP 11 Enterprise customers.

To find out the version of WPSHelper

1. Right-click C:\Windows\system32\drivers\wpshelper.sys.
2. On the Version tab, click Properties.

If the driver version is not current, run Liveupdate to update it.