mfehidk Warnings with VSE8.8 installed

[akl71]

I am testing a VSE8.8 package now and so far all runs fine.

Only problem is that i get a warning in system log every 3 minutes

Event Type: Warning
Event Source: mfehidk
Event Category: (256)
Event ID: 516
Date:  25.01.2011
Time:  10:32:36
User:  N/A
Computer: xxx
Description:
Process **\VSTSKMGR.EXE pid (1936) contains signed but untrusted code, but was allowed to perform a privileged operation with a McAfee driver.

Anyone else with this problem?

vstskmgr.exe is a McAfee process and should not contain untrusted code

[dyilmaz]

Hi,

Make sure you have rebooted when it was not done yet. Files like the MFEHIDK are only swapped after reboot.

Also I could imagine one or more files having differnet file Version than expected, could have happened when going from VSE 8.7 to 8.8. I would suggest to check if the package is not the beta package and that File Version of the Taskmanager or MFEHIDK may be the one from 8.7 or so.

best regards

[pete_d_s]

I'm also seeing the same events logged. I attach a screenshot of the VsTskMgr file details which proves it's the 8.8 version. My system has been rebooted several times since the upgrade.

[PhilR]

Last time I got event ID 516 to do with VirusScan was on January 16th, 2009.  Haven't seen it since.

I've had no such problems with VSE 8.8 here.

[vittorio.c]

strange, uninstalling and reinstalling vse seems to solve the problem

[akl71]

uninstalled, rebooted, reinstalled, rebooted and problem persists

vstskmgr.exe is 8.8.0.777, mfehidk.sys is 14.3.0.514

tested VSE8.8 on another machine and there are no problems so far

[dyilmaz]

Ok that are the correct build Versions...

Message was edited by: dyilmaz on 1/25/11 9:17:53 AM CST

[wwarren]

Do people have a habit of restarting the McTaskManager (VSTSKMGR.exe) service?

You will see this event if you do that.

I can't think of any reasons why someone would do that though.

Perhaps there a timing condition that's causing the symptom to occur some other way?

[khume]

I installed 8.8 to 8 test machines, XP SP3 and Windows 7.  Some are getting the same message as above, others are getting this one.  ePOMVT was also deployed to these , and other machines a couple of weeks prior to the 8.8 deployment.  The machines without 8.8 are not receiving these messages.  Machines have been rebooted multiple times.  I am unable to proceed with my testing until this is resolved.  Does anyone have a fix??

[wwarren]

Would you like to see if taking a VM of the system (use VMConverter) seeing the event, and verify it still reproduces the issue, hopefully with some consistency?

That would be most helpful for furthering the investigation if such a thing can be done.