1 2 3 Previous Next 44 Replies Latest reply on Mar 4, 2015 1:35 PM by feeeds

    mfehidk "warning" event-ID 516 referring to MCSHIELD.EXE, MCSVHOST.EXE and a McAfee-Driver

    tomica

      A look through the event manager on my Vista Business SP2 notebook reveals that since I recently updated from McAfee Security  Center to McAfee AntiVirusPlus the following mfehidk "warning" event-ID 516 occurs every few minutes.

       

      [quote]Process **\MCSHIELD.EXE pid (3648) contains a certified but untrustworthy content. The execution of a preferred Operation with a McAfee-Driver, however, was permitted. [/quote]

       

      The same warning message appears with/for MCSVHOST.EXE

       

      Although this does not seem to impair the running of the PC, it unnecessarily uses resources, and I would like to know how to eliminate this irritation. Thanks in advance for any advice/tips.

      Doesn't McAfee have a patch for this?

        • 1. Re: mfehidk "warning" event-ID 516 referring to MCSHIELD.EXE, MCSVHOST.EXE and a McAfee-Driver
          Dinz

          Hi tomica,

          Please let me know whether the upgrade from security center to Antivirus plus happened by running the removal tool and removing all the traces of your previous mcafee programs ?

          Also , provide me certain details such as ;

          What operating syste we use ?
          How old is the computer ?

          Do we have any other security software installed in the machine ?

          What is the RAM size of the computer ?

           

          Please update me with the above details so that we could proceed further . . .

           

           

          Regards,
          Dinesh K

          McAfee Online Community Moderator

          • 2. Re: mfehidk "warning" event-ID 516 referring to MCSHIELD.EXE, MCSVHOST.EXE and a McAfee-Driver
            tomica

            Hi Dinesh

             

             

            Thanks for your reply and interest.

             

            Answers to your questions…

             

            [quote]Please let me know whether the upgrade from security center to Antivirus plus happened by running the removal tool and removing all the traces of your previous Mcafee programs ?[/quote]

             

            Answer: The upgrade took place completely automatically as part of – what appeared to be – one of McAfee's routine periodic updates. I did not have to intervene. The programme itself works fine; it's just the reams of warnings in the Event Manager for every session that bother me. They started appearing after the upgrade. I have a less powerful XP Pro PC that had the same upgrade and does not have this problem. Someone suggested that McAfee AntiVirus Plus did not have a Microsoft certificate. A Google search of  "mfehidk" shows that ther are other McAfee users with mfehidk-related problems.

             

            [quote]What operating system we use[/quote]

             

            Answer: Vista Business SP2 – 32 Bit; Processor 2.27 GHz

             

            [quote]How old is the computer[/quote]

             

            Answer: An HP 6730b notebook – about 15 months old.

             

            [quote]Do we have any other security software installed in the machine[/quote]

             

            Answer: No – the Windows Firewall and Defender are deactivated. All Windows updates are up to date.

             

            [quote]What is the RAM size of the computer[/quote]

             

            Answer: 2 GB

             

            Thanks in advance for your help

             

             

            Nachricht geändert durch tomica on 12.05.10 11:21:59 CDT
            • 3. Re: mfehidk "warning" event-ID 516 referring to MCSHIELD.EXE, MCSVHOST.EXE and a McAfee-Driver
              tomica

              Hi Dinesh,

               

              have you been able to make any progress with mfehidk? I've attached a screen shot of what I mean, so you can see how many appear within even a short space of time. Look forward to hearing from you. Surely other McAfee and Vista Business Users must have this problem.

               

              Best regards

               

              Konrad Tomica

              • 4. Re: mfehidk "warning" event-ID 516 referring to MCSHIELD.EXE, MCSVHOST.EXE and a McAfee-Driver
                confour

                Yep running a super updated  - HP EliteBook 8530p - approx 18mnths old

                 

                OS Name Microsoft Windows XP Professional
                Version 5.1.2600 Service Pack 3 Build 2600
                OS Manufacturer Microsoft Corporation
                System Name AC-CF1111
                System Manufacturer Hewlett-Packard
                System Model HP EliteBook 8530p
                System Type X86-based PC
                Processor x86 Family 6 Model 23 Stepping 6 GenuineIntel ~2527 Mhz
                BIOS Version/Date Hewlett-Packard 68PDV Ver. F.11, 08/12/2009
                SMBIOS Version 2.4
                Windows Directory C:\WINDOWS
                System Directory C:\WINDOWS\system32
                Boot Device \Device\HarddiskVolume1
                Locale Australia
                Hardware Abstraction Layer Version = "5.1.2600.5512 (xpsp.080413-2111)"
                Total Physical Memory 4,096.00 MB
                Available Physical Memory 2.13 GB
                Total Virtual Memory 2.00 GB
                Available Virtual Memory 1.96 GB
                Page File Space 7.30 GB
                Page File C:\pagefile.sys

                 

                GETTING ABOUT 10 WARNING MESSAGES WITHIN MINUTES APART AFTER STARTING UP - AS FOLLOWS:

                 

                Event Type: Warning
                Event Source: mfehidk
                Event Category: (256)
                Event ID: 516
                Date:  06/08/2010
                Time:  17:07:22
                User:  N/A
                Computer: AC-CF1111
                Description:
                Process **\MCSHIELD.EXE pid (3340) contains signed but untrusted code, but was allowed to perform a privileged operation with a McAfee driver.
                Data:
                0000: 00 00 00 00 03 00 58 00   ......X.
                0008: 00 01 00 00 04 02 00 81   .......
                0010: 00 00 00 00 00 00 00 00   ........
                0018: 00 00 00 00 00 00 00 00   ........
                0020: 00 00 00 00 00 00 00 00   ........

                • 5. Re: mfehidk "warning" event-ID 516 referring to MCSHIELD.EXE, MCSVHOST.EXE and a McAfee-Driver
                  tomica

                  Hi confour,

                   

                  Thanks for your input. I was interested to see that someone else had noticed the same mfehidk warning. As you have the same make of computer as I do, I wonder if it's an HP-linked probelm. I downloaded my McAfee AntiVirus Plus from the McAfee website after I bought my PC from my employer - I didn't get McAfee Total Protection from HP's support website. Could that be the problem? On the other hand someone suggested that it was because McAfee AntiVirus Plus does not have the requisite certificate from Microsoft.

                   

                  I also have an HP Compaq nx9030 with XP Pro SP3 with the same McAfee AntiVirus Plus, and the mfehidk warning does not appear in the Event Manager.

                   

                  Best regards

                   

                  tomica

                  • 6. Re: mfehidk "warning" event-ID 516 referring to MCSHIELD.EXE, MCSVHOST.EXE and a McAfee-Driver

                    Hi I'm getting the same error and my PC is a custom build:

                     

                    AMD Phenom(tm) 9850 Quad-Core Processor

                    4.00 GB DDR3 RAM

                    Dual NVIDIA GeForce 1Gb 8600 GT SLi

                    Dual 500Gb RAID 0

                    Dual 500Gb RAID 1

                    Windows 7 Ultimate 64bit

                     

                    McAfee Internet Security Suite as part of my Sky subscription.

                     

                    Process **\MCSVHOST.EXE pid (2800) contains signed but untrusted code, but was allowed to perform a privileged operation with a McAfee driver.

                     

                     

                    - System

                      - Provider

                      [ Name]  mfehidk

                      - EventID 516

                      [ Qualifiers]  33024

                       Level 3

                      Task 256

                       Keywords 0x80000000000000

                    - TimeCreated

                       [ SystemTime]  2010-08-13T08:35:02.668600000Z

                      EventRecordID 59056

                       Channel System

                       Computer Win7-64PC

                       Security

                    - EventData  \Device\mfehidk
                       **\MCSVHOST.EXE
                       2800
                       0000000003003000000100000402008100000000000000000000000000000000000000000000000 0

                     

                     

                    Binary data:

                    In Words

                    0000: 00000000 00300003 00000100 81000204
                    0008: 00000000 00000000 00000000 00000000
                    0010: 00000000 00000000

                    In Bytes

                    0000: 00 00 00 00 03 00 30 00 ......0.
                    0008: 00 01 00 00 04 02 00 81 .......
                    0010: 00 00 00 00 00 00 00 00 ........
                    0018: 00 00 00 00 00 00 00 00 ........
                    0020: 00 00 00 00 00 00 00 00 ........

                    • 7. Re: mfehidk "warning" event-ID 516 referring to MCSHIELD.EXE, MCSVHOST.EXE and a McAfee-Driver

                      I have the same problem which occured immediately after "upgrading" to the latest security center (downloaded on 7/30/2010 - not sure how to get the "version"). The following is the "warning" that I get which seems to occur approximately every 6 hours on my Windows 7 Ultimate x64 machine:

                       

                      "Process **\MCSVHOST.EXE pid (2160) contains signed but untrusted code, but was allowed to perform a privileged operation with a McAfee driver."

                       

                      McAffee has been clueless about understanding this issue to date and had me remove and reinstall security center as well as delete all files in "C:\ProgramData\McAfee\HackerWatch\data" (which appears to be a standard MO regardless of the problem). I just renewed my subscription and am thinking I may go back to Norton as I never had a problem with Norton technology. McAfee, if you can sort this out I'd appreciate it.

                       

                       

                      Message was edited by: zipperhead357 on 8/14/10 10:50:10 AM CDT
                      • 8. Re: mfehidk "warning" event-ID 516 referring to MCSHIELD.EXE, MCSVHOST.EXE and a McAfee-Driver

                        Was this issue ever sorted out? I have the same problem on a WINXP system.

                        • 9. Re: mfehidk "warning" event-ID 516 referring to MCSHIELD.EXE, MCSVHOST.EXE and a McAfee-Driver
                          tomica

                          Hi,

                           

                          Not to my knowledge. Dinesh K, McAfee Online Community Moderator, asked me some questions about my system, but never reverted. From the thread, you'll see that several other McAfee users have reported the same phenomenon. I did write to McAfee 's German HQ, but never got a reply. (I live in Germany)

                           

                          regards

                          1 2 3 Previous Next