Skip navigation
McAfee Secure sites help keep you safe from identity theft, credit card fraud, spyware, spam, viruses and online scams
32023 Views 60 Replies Latest reply: Feb 27, 2012 5:39 AM by Alba RSS 1 2 3 ... 7 Previous Next
diwi Apprentice 51 posts since
Aug 10, 2011
Currently Being Moderated

Aug 10, 2011 9:02 AM

VSE 8.8.0 installed and Event ID 519 / Source mfehidk

Hello,

 

we use ePO 4.5.4 Build 1082 together with McAfee Agent 4.5.0.1852 to manage our Workstations and Servers. VirusScan 8.8.0 has been deployed to 6 servers at the moment. 2 of the 6 servers are running Windows Server 2008 SP2 x64 and the other 4 servers are running Windows Server 2003 SP2 x86. All these servers had VirusScan 8.7.0 Patch 4 installed before.

 

VirusScan 8.7.0 Patch 4 had been deleted via ePO 3.6.x, as well as the old 3.6.x agent. Directories like ...

 

     C:\Documents and Settings\All Users\Application Data\McAfee

     C:\Program Files\Common Files\McAfee

     C:\Program Files\McAfee

 

had been cleaned and removed (also C:\Windows\Temp had been cleaned).

 

Afterwards a fresh install of the McAfee Agent 4.5.0.1852 had been deployed, followed by VirusScan 8.8.0 including DAT-updates!

 

 

Now, I have probs on one Windows Server 2003 SP2 x86 machine ... after some days the server starts logging the following event ...

 

*******************************************************

Event Type:    Warning

Event Source:    mfehidk

Event Category:    (256)

Event ID:    519

Date:        8/2/2011

Time:        12:11:55 AM

User:        N/A

Computer:    <Servername>

Description:

The description for Event ID ( 519 ) in Source ( mfehidk ) cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. You may be able to use the /AUXSOURCE= flag to retrieve this description; see Help and Support for details. The following information is part of the event: \Device\mfehidk, **\VSTSKMGR.EXE, 2196.

Data:

0000: 00 00 00 00 03 00 58 00   ......X.

0008: 00 01 00 00 07 02 00 81   .......&#129;

0010: 00 00 00 00 00 00 00 00   ........

0018: 00 00 00 00 00 00 00 00   ........

0020: 00 00 00 00 00 00 00 00   ........

*******************************************************

 

 

This event (when it starts to happen) repeats unregularly and is accompanied by several event id 333 (Application popup) entries during a time, when backup happens. The result of the behaviour is a file server to which no user can connect to or been able to login on the console. The only choice you have, is to reset/reboot the system. From the time of the reboot, everything works normally for some days and the same error (also in event log) happens again.

 

In a first step, I completely removed VirusScan and the agent via ePO and cleaned/removed registry and directories and re-installed everything again, but the error remains!

 

Anybody else with this behaviour or errors or with a solution?

 

Best regards,

DiWi

 

Message was edited by: diwi on 8/10/11 4:02:08 PM CEST
  • raovi Newcomer 8 posts since
    Oct 22, 2010
    Currently Being Moderated
    1. Sep 8, 2011 8:57 AM (in response to diwi)
    Re: VSE 8.8.0 installed and Event ID 519 / Source mfehidk

    I am also facing the same issue in the servers where i deployed McAfee VSE 8.8. But this does not appear to happen in all the server. And also when this events starts occuring the Page fille memory shoots up and forces us to restart the server.

    Do anyone have the solution for this?

  • raovi Newcomer 8 posts since
    Oct 22, 2010
    Currently Being Moderated
    3. Sep 8, 2011 10:11 AM (in response to diwi)
    Re: VSE 8.8.0 installed and Event ID 519 / Source mfehidk

    hi diwi,

     

    Seems like only we are running on this side. Even i have logged a call with McAfee Gold support and they have not yet escalated it.

    Though rolling back to 8.7 patch4 solves the issue we want to know why VSE 8.8 is affecting only few servers.

    Just a fast question :-

     

    Did you face High memory usage during this error?

     

    Hope McAfee will come up with a better solution.

     

     

    Regards,

    Raovi

  • raovi Newcomer 8 posts since
    Oct 22, 2010
    Currently Being Moderated
    5. Sep 8, 2011 11:01 AM (in response to diwi)
    Re: VSE 8.8.0 installed and Event ID 519 / Source mfehidk

    Thanks DIWI

     

    i am still trying to escalate the issue with McAfee but they keep saying the details from MER tool is not enough for them

  • psolinski Apprentice 162 posts since
    Feb 10, 2005
    Currently Being Moderated
    7. Sep 9, 2011 12:58 AM (in response to raovi)
    Re: VSE 8.8.0 installed and Event ID 519 / Source mfehidk

    We experience the same issue on some of our w2k3 servers.

     

    Regards

    P.

  • psolinski Apprentice 162 posts since
    Feb 10, 2005
    Currently Being Moderated
    9. Sep 9, 2011 1:54 AM (in response to diwi)
    Re: VSE 8.8.0 installed and Event ID 519 / Source mfehidk

    Reported some time ago, now with Tier III

1 2 3 ... 7 Previous Next

More Like This

  • Retrieving data ...

Bookmarked By (0)

Legend

  • Correct Answers - 5 points
  • Helpful Answers - 3 points