This article is one of several that cover the Event IDs 514, 516, and 519 generated by VSE. Each article covers a different cause and includes a different solution.

IMPORTANT: Event IDs 514, 516, and 519 do not indicate an issue with the VSE product; it relates to a new VSE security feature.
 

Event 516 occurs for legitimate reasons to raise awareness for the administrator that VSE code might be compromised. When a process is permitted to run foreign code from within the address space of a McAfee process, some Access Protection rules might be circumvented because most Access Protection rules trust McAfee processes. Many third-party applications use this technique to provide valuable functionality to an organization. But, these Event IDs can also indicate a system infection with root-kit-like malware or that you are running an intrusive third-party application.

VSE generates this event when one of the following occurs:

• One or more DLL files loaded by the mentioned process are from a third-party vendor, not McAfee or Microsoft, and contain untrusted code.
• The DLL files loaded by the mentioned process are from Microsoft, which is expected to be trusted, but the trust validation routine returns a failure.
• The McAfee Agent loads certain DLL files that do not contain the signature needed for inspection by VSE 8.8.