This is one of several articles that cover the Event IDs 514, 516, and 519 generated by VirusScan Enterprise (VSE). Each article covers a different cause and includes a different solution.
IMPORTANT: Event ID 514/516/519 does not indicate an issue with VSE; it relates to a new VSE security feature.
Event IDs 514, 516, and 519 occur for legitimate reasons to raise awareness for the Administrator that VSE code may be compromised. When a process has been permitted to run foreign code from within the address space of a VSE process, some Access Protection rules may be circumvented because most Access Protection rules trust McAfee processes. Many third party applications use this technique to provide valuable functionality to an organization. However, these Event IDs can also indicate that the system is infected with root-kit-like malware or that you are running an intrusive third party application.
VSE generates this event when one of the following occurs:
- One or more DLL files loaded by the mentioned process are from a third-party vendor (not McAfee or Microsoft) and contain untrusted code.
- The DLL files loaded by the mentioned process are from Microsoft (which are expected to be trusted), but the trust validation routine returns a failure.
- The McAfee Agent loads certain DLL files which do not contain the necessary signature required for inspection by VSE 8.8.
This article addresses the issue caused by Microsoft DLL files.
