shieldwp.sys

Horizon DataSys disk-filter driver (write-protection variant)

From Horizon DataSys Inc.

Part of the Horizon family

Status

On a known-vulnerable list

Known variants

1 distinct hashes

Field notes

shieldwp.sys is the write-protection variant of the kernel disk-filter shipped by Horizon DataSys with RollBack Rx Professional and Reboot Restore Rx Professional. It works alongside shield.sys (the primary filter) and shield-async.sys (the asynchronous variant) inside the same product install.

The three siblings are on the public LOLDrivers list (May 2026, issue #344). See the shield.sys entry for the shared product context.

If you use RollBack Rx or Reboot Restore Rx, the driver is expected. If you do not, look at what installed it.

What the record shows

shieldwp.sys is listed as a known-vulnerable driver on the public LOLDrivers project. One distinct binary hash matching this filename is on record.

What this means, plainly

Presence is not proof of misuse. Driver files on the LOLDrivers list commonly ship with legitimate hardware tools, gaming software, or vendor utilities. Their presence is recorded as evidence on a record. It is never treated as a verdict about a person.

Related drivers

Other drivers in the Horizon family. See the whole family →

shield-async.sys shield.sys

Source

Status data comes from the public LOLDrivers project, a community-curated registry of drivers known to be vulnerable or malicious. The snapshot Vera uses was refreshed July 10, 2026. CVE links go to the NIST National Vulnerability Database.

In plain words

Kernel driver BYOVD Ring 0 Code-signing certificate Certificate revocation The full glossary →

Cite this entry

Vera Project. “shieldwp.sys.” Vera Field Guide (Driver). The Vera Project. https://www.veraproject.xyz/field-guide/drivers/shieldwp-sys