Identify trust issues when the System Event Log reports Event ID 514, 516, or 519

Technical Articles ID: KB87795
Last Modified: 12/22/2021

Environment

McAfee Agent 5.x
McAfee Application and Change Control 8.x, 7.x, 6.x
McAfee Data Exchange Layer 6.x, 5.x
McAfee Data Loss Prevention Endpoint 11.x
McAfee Endpoint Intelligence Agent 3.x, 2.x
McAfee Endpoint Security 10.x
McAfee Host Intrusion Prevention 8.x
McAfee VirusScan Enterprise 8.x
SysCore 15.3 or later

Summary

This article describes how to use the built-in SysCore utility VtpInfo. You use this utility to determine the trust state of a module or process when you are troubleshooting issues where the System Event Log reports Event ID 514, 516, or 519.

The VtpInfo command determines whether McAfee trusts a module (DLL or EXE) or process (EXE). If a process is not trusted, the command output identifies what components are the cause.

Problem

The Windows System Event Log reports multiple entries for Event ID 514, 516, or 519 similar to the following:

Event Type: Warning
Event Source: mfehidk
Event Category: (256)
Event ID: 514
Description:
Process C:\Program Files\McAfee\VirusScan Enterprise\ pid (###) contained unsigned or corrupted code and was blocked from performing a privileged operation with a McAfee driver

Event Type: Warning
Event Source: mfehidk
Event Category: (256)
Event ID: 516
Description:
Process **\VSTSKMGR.EXE pid (XXXX) contains signed but untrusted code, but was allowed to perform a privileged operation with a McAfee driver

Event Type: Warning
Event Source: mfehidk
Event Category: (256)
Event ID: 519
Description:
Process **\VSTSKMGR.EXE pid (####) could not be successfully validated with the mfevtp service and was blocked from performing a privileged operation with a McAfee driver

Event Type: Warning
Event Source: mfehidk
Event Category: (256)
Event ID: 514
Description:
Process **\OUTLOOK.EXE pid (###) contained unsigned or corrupted code and was blocked from performing a privileged operation with a McAfee driver

On some systems, the event is logged every few minutes.

No other symptoms are reported on the client.

IMPORTANT: Product function and performance are not impacted.

Solution

Use the VtpInfo tool to determine the trust state of a file on disk or of a running process. Use the following commands from an elevated command prompt:

vtpinfo.exe /validatemodule "<full path to DLL or EXE>"

vtpinfo.exe /validateprocess <process ID (PID) that the application is running as>

To save a file with the trust status information for the module or process, run the following commands from an elevated command prompt:

NOTE: Make sure the directory C:\Temp\ exists before running the command or it fails. The command does not create the target directory.

"C:\Program Files\Common Files\McAfee\SystemCore\vtpinfo.exe" /validatemodule "<full path to DLL or EXE>" >C:\Temp\vtpinfo.txt

"C:\Program Files\Common Files\McAfee\SystemCore\vtpinfo.exe" /validateprocess <PID that the application is running as> >C:\Temp\vtpinfo.txt

Review the file vtpinfo.txt. Determine what is trusted or untrusted in the specified module or process. All modules loaded into the process being queried are listed in the results with their trust status. In the end of the file, the aggregate result displays. If you see validation_state= VALIDATION_STATE_INVALID or privileges= PRIVILEGE_NONE, the module or process is not trusted.

After you identify the untrusted module or process, contact the vendor to determine how to prevent the binary from injecting into McAfee software.

Related Information

The following articles describe issues where VirusScan Enterprise generates the Event IDs 514, 516, and 519:

Affected Products

Application and Change Control 8.3.x
Application and Change Control 8.2.x
Application and Change Control 8.1.x
Application and Change Control 8.0.x
Application and Change Control 7.0.x (EOL)
Application and Change Control 6.2.x
Application and Change Control 6.1 (EOL)
Data Exchange Layer 6.x
Data Exchange Layer 5.x
Data Loss Prevention Endpoint 11.4.x (EOL)
Diagnostic Data Collection
Endpoint Intelligence Agent 3.x
Endpoint Intelligence Agent 2.6
Endpoint Security Firewall 10.7.x
Endpoint Security Firewall 10.6.x
Endpoint Security Threat Prevention 10.7.x
Endpoint Security Threat Prevention 10.6.x
Endpoint Security Web Control 10.7.x
Endpoint Security Web Control 10.6.x
Host Intrusion Prevention 8.0 (EOL)
McAfee Agent 5.7.x
McAfee Agent 5.6.x
Troubleshooting
VirusScan Enterprise 8.8 (EOL)

Languages:

This article is available in the following languages:

German
English United States
Spanish Spain
French
Italian
Japanese
Korean
Dutch
Portuguese Brasileiro
Chinese Simplified
Chinese Traditional

Knowledge Center

Identify trust issues when the System Event Log reports Event ID 514, 516, or 519

Environment

Summary

Problem

Solution

Related Information

Affected Products

Languages:

Title

Title

Knowledge Center

Identify trust issues when the System Event Log reports Event ID 514, 516, or 519

Environment

Summary

Problem

Solution

Related Information

Affected Products

Languages:

Choose your region

Title

Title