Loading...

Knowledge Center


Event ID 514/516/519, Warning, Process **\VSTSKMGR.EXE pid (XXXX) contains signed but untrusted code (issue: third-party application DLL)
Technical Articles ID:   KB74176
Last Modified:  4/7/2017
Rated:


Environment

McAfee VirusScan Enterprise 8.8 with/without Patch 1

For details of VSE 8.x supported environments, see KB51111.

Summary

This is one of several articles that cover the Event ID 514/516/519 generated by VirusScan Enterprise (VSE). Each article covers a different cause and includes a different solution.

IMPORTANT: Event IDs 514, 516, and 519 do not indicate an issue with VSE; they relates to a new VSE security feature.

Event IDs 514, 516, and 519 occur for legitimate reasons to raise awareness for the Administrator that VSE code may be compromised. When a process has been permitted to run foreign code from within the address space of a process, some Access Protection rules may be circumvented because most Access Protection rules trust VSEprocesses. Many third-party applications use this technique to provide valuable functionality to an organization. However, these Event IDs can also indicate that the system is infected with root-kit-like malware or that you are running an intrusive third-party application.

VSE generates these events when one of the following occurs:

  • One or more DLL files loaded by the mentioned process are from a third-party vendor (not McAfee or Microsoft) and contain untrusted code.
  • The DLL files loaded by the mentioned process are from Microsoft (which are expected to be trusted), but the trust validation routine returns a failure.
  • The McAfee Agent loads certain DLL files which do not contain the necessary signature required for inspection by VSE 8.8.
This article addresses the issue caused by third-party application DLL files.

Problem

The Windows System Event log reports multiple entries for Event ID 514/516/519. Entries similar to the following are recorded in the Windows System Event log:

Event Type: Warning
Event Source: mfehidk
Event Category: (256)
Event ID: 514
Description:
Process C:\Program Files\McAfee\VirusScan Enterprise\ pid (###) contained unsigned or corrupted code and was blocked from performing a privileged operation with a McAfee driver

Event Type: Warning
Event Source: mfehidk
Event Category: (256)
Event ID: 516
Date:  <Date>
Time:  <time>
User:  N/A
Computer: <name>
Description:
Process **\VSTSKMGR.EXE pid (XXXX) contains signed but untrusted code, but was allowed to perform a privileged operation with a McAfee driver
 
Event Type: Warning
Event Source: mfehidk
Event Category: (256)
Event ID: 519
Description:
Process **\VSTSKMGR.EXE pid (####) could not be successfully validated with the mfevtp service and was blocked from performing a privileged operation with a McAfee driver
 

On some systems, the event is logged every few minutes.

No other symptoms are reported on the client.

IMPORTANT: VSE functionality and performance are not impacted.

System Change

Installed VSE 8.8 or VSE 8.7i with Patch 5 (repost).

Cause

Third-party application hooking occurs when third-party applications hook or inject their code into other processes to provide functionality. Some malware also uses this technique. These third-party programs (or malware) are not trusted by VSE, and an event is generated to inform the administrator that the process may be compromised.

Solution

Perform the steps below to troubleshoot issues where third-party code is inserted into VSE processes or interacts with McAfee kernel code from other processes.  
  1. Identification - troubleshoot
    This step is necessary to identify other possible causes and to provide the solutions.

    Know why the event occurs for your environment - it could be malware.
    1. Review the Event ID to determine which process is involved. Most commonly this is VSTSKMGR.EXE as described in the Problem section. Other process names include MCSHIELD.EXE and SVCHOST.EXE.  
    2. Identify the individual DLL(s) and owning applications for files that load themselves into that process.   
      1. Download Microsoft Process Explorer from http://technet.microsoft.com/en-us/sysinternals/bb896653.
      2. Run the Process Explorer tool procexp.exe on the computer where you see the event 516.
      3. From the Process Explorer main menu, click Options and select Verify Image Signatures.
      4. From the main menu click View and select Show Lower Pane.
      5. Click View, Lower Pane View, and select DLLs.
      6. Click View, Select Columns.
      7. In the new window click the DLL tab, and select Verified Signer, then click OK.
      8. In the upper pane, expand winnt.exe, services and scroll down, then select VsTskMgr.exe.

        The lower pane now shows all the DLLs that are loaded for the VsTskMgr.exe process.
         
      9. In the lower pane click the Verified Signer column to organize the DLLs. This allows any unsigned DLLs to be grouped together as Unable to Verify.
      10. Inspect the list of DLLs for non-McAfee and non-Microsoft files (ignoring the file WscAv.dll which is also a McAfee file).
      11. If you do not see the untrusted third-party application's DLL(s), click File, Save and save as a text file. Provide the text file to Technical Support for assistance. For contact details, see the Related information section of this article..

         
  2. Resolve the third-party application (hook) problem
    If the DLL can be prevented from loading into the process, then VSE would not generate the event.
Deal with intrusive third-party applications
If you determine that the events are caused by a third-party application, and no option exists from the vendor to avoid hooking VSE processes or otherwise engaging with VSEcode, you can opt to trust the application so that no more Event 516 messages will be generated for that specific application. These events will still occur for other applications and for malware.

NOTE: An application can only be trusted if it has a digital signature. If it does not, VSE can never trust it. There is no way to suppress events for unsigned applications.

Risks associated with trusting a third-party application
Files that contain a digital certificate that you choose to trust are still scanned when first accessed. VSE utilizes a clean-file scan cache to avoid re-scanning files that have already been scanned and found to be clean. Files that are trusted are added to the cache and will remain in the cache even after a DAT signature update occurs. This behavior is inherent with trusting digital signatures.

NOTE: When you add a file to the scan cache, the stored data includes the settings used to scan the file. If your scan settings are changed to a higher (more secure) level, then trusted items in the cache would be rescanned.
  • Advantage: You may see a performance gain, even after a DAT update.
  • Disadvantage: If new DAT signatures would normally find those trusted files to be infected, they would not be scanned by the On-Access Scanner to find that malware. 
 
Mitigation
McAfee reserves the right to use the DAT signature updates to force trusted files to be removed from the clean-file scan cache, causing them to be re-scanned when accessed. You can also cause existing trusted files to be scanned. Perform an On-Demand Scan and disable the option Allow On-Demand scans to utilize the scan cache. See the Related Information section for additional information. 
 
How to trust a third-party application
  1. Obtain the signature file.
    1. Right-click the third-party DLL file (or any of the third-party application signed files) and select Properties.
    2. Click the Digital Signatures tab.
    3. Select the appropriate digital signature from the Signature list.
    4. Click Details, View Certificate.
    5. Click the Details tab, then click Copy to File.
    6. Complete the Certificate Export Wizard and note where you save the .cer file. The product development team recommends that you accept the default wizard options, with the exception of the file path. 
  2. Import a copy of the product's digital certificate into the Trust certificate store.
    1. Contact Technical Support. See the Related Information section for the contact details.
    2. Provide the .cer file you want to add.
      Technical Support will provide an executable package to add the certificate to the Trust certificate store.
    3. Run the executable provided by Technical Support. (Steps to do so via ePolicy Orchestrator will be provided by Technical Support.)
    4. Click Tools, General Options, Global Scan Settings and deselect Enable saving scan data across reboots, then click Apply, OK.
    5. Restart your computer. This is necessary for the certificate store changes to take effect.
    6. Click Tools, General Options, Global Scan Settings and select Enable saving scan data across reboots, then click Apply, OK.
After these steps the Event 516 will no longer occur for the newly trusted third-party application.

NOTES: For more advanced users, there are other methods to update the certificate store:
  1. Reduce the number of events recorded in the Windows System event log
    This issue is resolved in VSE 8.8 Patch 2 release, which is available from the Product Downloads site using a valid Grant Number.

    Patches are cumulative. Therefore, The product development team recommends that you install the latest one.

    VSE 8.8 Patch 11 is the latest patch available from the Downloads tab on the ServicePortal at https://support.mcafee.com/downloads.

    NOTE: VSE 8.8 Patch 11 supports all supported Windows operating systems.


    NOTE: This behavior was initially resolved with VSE 8.8 Patch 1 Hotfix 625756, but due to some installation issues and conflicts with the Host Intrusion Prevention agent, the hotfix was removed. This was then superseded by VSE 8.8 Patch 1 Hotfix 735512 to address this issue. The hotfix has been removed due to the release of VSE 8.8 Patch 2.

    McAfee product software, upgrades, maintenance releases, and documentation are available from the Product Downloads site at: http://www.mcafee.com/us/downloads/downloads.aspx.

    NOTE: You need a valid Grant Number for access. KB56057 provides additional information about the Product Downloads site, and alternate locations for some products.

Solution

If the above solution does not resolve this issue, refer to the master troubleshooting article KB71083 for other possible solutions.

Rate this document

Beta Translate with

Select a desired language below to translate this page.

Glossary of Technical Terms


 Highlight Glossary Terms

Please take a moment to browse our Glossary of Technical Terms.