Knowledge Center

1. Identification - troubleshoot
   This step is necessary to identify other possible causes and to provide the solutions.
   
   Know why the event occurs for your environment - it could be malware.
   1. Review the Event ID to determine which process is involved. Most commonly this is VSTSKMGR.EXE as described in the Problem section. Other process names include MCSHIELD.EXE and SVCHOST.EXE.  
   2. Identify the individual DLL(s) and owning applications for files that load themselves into that process.   
      1. Download Microsoft Process Explorer from http://technet.microsoft.com/en-us/sysinternals/bb896653.
      2. Run the Process Explorer tool procexp.exe on the computer where you see the event 516.
      3. From the Process Explorer main menu, click Options and select Verify Image Signatures.
      4. From the main menu click View and select Show Lower Pane.
      5. Click View, Lower Pane View, and select DLLs.
      6. Click View, Select Columns.
      7. In the new window click the DLL tab, and select Verified Signer, then click OK.
      8. In the upper pane, expand winnt.exe, services and scroll down, then select VsTskMgr.exe.
         
         The lower pane now shows all the DLLs that are loaded for the VsTskMgr.exe process.
          
      9. In the lower pane click the Verified Signer column to organize the DLLs. This allows any unsigned DLLs to be grouped together as Unable to Verify.
      10. Inspect the list of DLLs for non-McAfee and non-Microsoft files (ignoring the file WscAv.dll which is also a McAfee file).
      11. If you do not see the untrusted third-party application's DLL(s), click File, Save and save as a text file. Provide the text file to Technical Support for assistance. For contact details, see the Related information section of this article..
          
           
2. Resolve the third-party application (hook) problem
   If the DLL can be prevented from loading into the process, then VSE would not generate the event.

• Advantage: You may see a performance gain, even after a DAT update.
• Disadvantage: If new DAT signatures would normally find those trusted files to be infected, they would not be scanned by the On-Access Scanner to find that malware. 

 

1. Obtain the signature file.
   1. Right-click the third-party DLL file (or any of the third-party application signed files) and select Properties.
   2. Click the Digital Signatures tab.
   3. Select the appropriate digital signature from the Signature list.
   4. Click Details, View Certificate.
   5. Click the Details tab, then click Copy to File.
   6. Complete the Certificate Export Wizard and note where you save the .cer file. The product development team recommends that you accept the default wizard options, with the exception of the file path. 
2. Import a copy of the product's digital certificate into the Trust certificate store.
   1. Contact Technical Support. See the Related Information section for the contact details.
   2. Provide the .cer file you want to add.
      Technical Support will provide an executable package to add the certificate to the Trust certificate store.
   3. Run the executable provided by Technical Support. (Steps to do so via ePolicy Orchestrator will be provided by Technical Support.)
   4. Click Tools, General Options, Global Scan Settings and deselect Enable saving scan data across reboots, then click Apply, OK.
   5. Restart your computer. This is necessary for the certificate store changes to take effect.
   6. Click Tools, General Options, Global Scan Settings and select Enable saving scan data across reboots, then click Apply, OK.

• The Microsoft MMC snap-in. See http://technet.microsoft.com/en-us/library/cc770355.aspx.
• The Microsoft CERTMGR.exe tool. See http://msdn.microsoft.com/en-us/library/windows/desktop/aa376553.
  (The executable provided by Technical Support makes use of the CERTMGR.EXE tool.)   
    

3. Reduce the number of events recorded in the Windows System event log
   This issue is resolved in VSE 8.8 Patch 2 release, which is available from the Product Downloads site using a valid Grant Number.
   
   Patches are cumulative. Therefore, The product development team recommends that you install the latest one.
   
   

   VSE 8.8 Patch 11 is the latest patch available from the Downloads tab on the ServicePortal at https://support.mcafee.com/downloads.
   
   NOTE: VSE 8.8 Patch 11 supports all supported Windows operating systems.

   
   
   NOTE: This behavior was initially resolved with VSE 8.8 Patch 1 Hotfix 625756, but due to some installation issues and conflicts with the Host Intrusion Prevention agent, the hotfix was removed. This was then superseded by VSE 8.8 Patch 1 Hotfix 735512 to address this issue. The hotfix has been removed due to the release of VSE 8.8 Patch 2.
   
   

   McAfee product software, upgrades, maintenance releases, and documentation are available from the Product Downloads site at: http://www.mcafee.com/us/downloads/downloads.aspx.
   
   NOTE: You need a valid Grant Number for access. KB56057 provides additional information about the Product Downloads site, and alternate locations for some products.