Support Tool Error: SRTSP Service

book

Article ID: 177905

calendar_today

Updated On:

Products

Endpoint Protection

Issue/Introduction

The Symantec Endpoint Protection Support Tool reports that SRTSP is not running.

Resolution

SRTSP(L) is the driver which is used to facilitate real time scanning of files. Depending on the OS, there are two different drivers which can be used:
Mini filter: Srtsp.sys: XP SP2, W2k3S SP1, Vista, 2008
legacy AP: Srtspl.sys, XP Pre SP2, W2k3S Pre SP1 and Windows 2000


Mini-filter AutoProtect uses Microsoft’s own filter manager to hook file system activity. Mini-filter AutoProtect registers with filter manager, which passes the file information to AutoProtect for scanning. For more information on mini-filters see http://msdn.microsoft.com/en-us/library/ms793580.aspx.

Legacy mode AutoProtect uses Symantec’s SymEvent driver to hook file system activity. SymEvent passes the file information to AutoProtect for scanning. Legacy AutoProtect originated with SAV’s real time file scanning. It has the same functionality as mini-filter AutoProtect.

It is assumed that eventually Microsoft will stop allowing legacy file system filter drivers like Symevent to load, which is why a mini-filter version of Autoprotect was created

The Support Tool detecting an issue with either SRTSP, or SRTSPL indicates that there is an issue with Autoprotect on your system.

Issues related to this driver:

          • Network shares become unresponsive on Windows Server 2008 32-bit with Symantec Endpoint Protection 11 Auto-Protect enabled 2008061812370848
          • Error: “Stop 0x7f” when running a Symantec Antivirus or Symantec Endpoint Protection Scan 2008011018502648
          • Symantec Endpoint Protection Auto-Protect Error: Auto-Protect loaded the default configuration 2007103011093948