"MSI.DLL" DLL not signed (Event ID 514/516/519)
Technical Articles ID:
KB74174
Last Modified: 5/21/2020
Environment
McAfee VirusScan Enterprise (VSE) 8.8 with or without Patch 1
Summary
This article is one of several articles that cover the Event IDs 514, 516, and 519 that VSE generates. Each article covers a different cause and includes a different solution.
IMPORTANT: Event IDs 514, 516, and 519 do not indicate an issue with VSE; they relate to a new VSE security feature.
Event IDs 514, 516, and 519 occur for legitimate reasons to raise awareness for the Administrator that VSE code might be compromised. When a process is permitted to run foreign code from within the address space of a VSE process, some Access Protection rules might be circumvented because most Access Protection rules trust McAfee processes. Many third-party applications use this technique to provide valuable functionality to an organization. But, these Event IDs can also indicate that the system is infected with root-kit-like malware or that you are running an intrusive third-party application.
VSE generates these events when one of the following occurs:
- One or more DLL files loaded by the mentioned process are from a third-party vendor, not McAfee or Microsoft, and contain untrusted code.
- The DLL files loaded by the mentioned process are from Microsoft, and expected to be trusted, but the trust validation routine returns a failure.
- The McAfee Agent loads certain DLL files that do not contain the needed signature needed for inspection by VSE 8.8.
This article addresses the issue caused by Microsoft DLL files.
Problem
The Windows System Event log reports multiple entries for Event ID 514, 516, or 519. The Windows System Event log records entries similar to the following:
Event Type: Warning
Event Source: mfehidk
Event Category: (256)
Event ID: 514
Description:
Process C:\Program Files\McAfee\VirusScan Enterprise\ pid (###) contained unsigned or corrupted code and was blocked from performing a privileged operation with a McAfee driver
Event Type: Warning
Event Source: mfehidk
Event Category: (256)
Event ID: 516
Description:
Process **\VSTSKMGR.EXE pid (XXXX) contains signed but untrusted code, but was allowed to perform a privileged operation with a McAfee driver
Event Type: Warning
Event Source: mfehidk
Event Category: (256)
Event ID: 519
Description:
Process **\VSTSKMGR.EXE pid (####) could not be successfully validated with the mfevtp service and was blocked from performing a privileged operation with a McAfee driver
On some systems, the event is logged every few minutes.
No other symptoms are reported on the client.
IMPORTANT: VSE functionality and performance are not impacted.
Cause
Microsoft DLL files cause this issue when the trust validation routine returns a failure. This failure occurs when there is no corresponding or valid certificate for the file. For example, this failure has been seen with MSI.dll from the MSI Installer 4.5.6001.22159.
Solution
To resolve this issue:
- Identification - troubleshoot
This step is necessary to identify other possible causes and to provide the solutions.
Know why the event occurs for your environment - it could be malware.
- Review the Event ID to determine which process is involved. Most commonly, the process is VSTSKMGR.EXE as described in the Problem section. Other process names include MCSHIELD.EXE and SVCHOST.EXE.
- Identify the individual DLLs and owning applications for files that load themselves into that process.
- Download Microsoft Process Explorer from http://technet.microsoft.com/en-us/sysinternals/bb896653.
- Run the Process Explorer tool procexp.exe on the computer where you see the event 516.
- From the Process Explorer main menu, click Options and select Verify Image Signatures.
- From the main menu, click View and select Show Lower Pane.
- Click View, Lower Pane View, and select DLLs.
- Click View, Select Columns.
- In the new window click the DLL tab, select Verified Signer, and then click OK.
- In the upper pane, expand wininit.exe, services, scroll down, and then select VsTskMgr.exe.
The lower pane now shows all DLLs that are loaded for the VsTskMgr.exe process.
- In the lower pane, click the Verified Signer column to organize the DLLs. This option allows any unsigned DLLs to be grouped as Unable to Verify.
- Inspect the list of DLLs for non-McAfee and non-Microsoft files. Ignore the file WscAv.dll, which is also a McAfee file.
- If you do not see the untrusted third-party application's DLLs, click File, Save, and save the file as a text file. Provide the text file to Technical Support for assistance. For contact details, see the Related information section of this article.
- Resolve the Microsoft DLL problem
When you identify the involved Microsoft DLL, you have to update the Microsoft Certificate Stores:
To address this issue for MSI.DLL (v4.5), see Microsoft Knowledge Base article http://support.microsoft.com/kb/972397.
In addition to the files listed, the related fix also installs an associated security catalog file (KBnumber.cat) that is signed with a Microsoft digital signature.
For more technical information about how Windows updates root certificates in Windows XP SP2 and SP3, see the Microsoft TechNet article at: http://technet.microsoft.com/en-us/library/bb457160.aspx.
For detailed technical information about how Windows updates root certificates in Windows Vista and later, see the Microsoft TechNet article at: http://technet.microsoft.com/en-us/library/cc749331(WS.10).aspx.
-
Reduce the number of events recorded in the Windows System event log
This issue is resolved VSE 8.8 Patch 2, which is available from the Product Downloads site using a valid Grant Number.
Patches are cumulative. Technical Support recommends that you install the latest one.
NOTE: This behavior was initially resolved with VSE 8.8 Patch 1 Hotfix 735512.The hotfix has been removed because of the release of VSE 8.8 Patch 2.
|
