1 2 3 Previous Next 60 Replies Latest reply: Feb 27, 2012 5:39 AM by Alba RSS

    VSE 8.8.0 installed and Event ID 519 / Source mfehidk




      we use ePO 4.5.4 Build 1082 together with McAfee Agent to manage our Workstations and Servers. VirusScan 8.8.0 has been deployed to 6 servers at the moment. 2 of the 6 servers are running Windows Server 2008 SP2 x64 and the other 4 servers are running Windows Server 2003 SP2 x86. All these servers had VirusScan 8.7.0 Patch 4 installed before.


      VirusScan 8.7.0 Patch 4 had been deleted via ePO 3.6.x, as well as the old 3.6.x agent. Directories like ...


           C:\Documents and Settings\All Users\Application Data\McAfee

           C:\Program Files\Common Files\McAfee

           C:\Program Files\McAfee


      had been cleaned and removed (also C:\Windows\Temp had been cleaned).


      Afterwards a fresh install of the McAfee Agent had been deployed, followed by VirusScan 8.8.0 including DAT-updates!



      Now, I have probs on one Windows Server 2003 SP2 x86 machine ... after some days the server starts logging the following event ...



      Event Type:    Warning

      Event Source:    mfehidk

      Event Category:    (256)

      Event ID:    519

      Date:        8/2/2011

      Time:        12:11:55 AM

      User:        N/A

      Computer:    <Servername>


      The description for Event ID ( 519 ) in Source ( mfehidk ) cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. You may be able to use the /AUXSOURCE= flag to retrieve this description; see Help and Support for details. The following information is part of the event: \Device\mfehidk, **\VSTSKMGR.EXE, 2196.


      0000: 00 00 00 00 03 00 58 00   ......X.

      0008: 00 01 00 00 07 02 00 81   .......&#129;

      0010: 00 00 00 00 00 00 00 00   ........

      0018: 00 00 00 00 00 00 00 00   ........

      0020: 00 00 00 00 00 00 00 00   ........




      This event (when it starts to happen) repeats unregularly and is accompanied by several event id 333 (Application popup) entries during a time, when backup happens. The result of the behaviour is a file server to which no user can connect to or been able to login on the console. The only choice you have, is to reset/reboot the system. From the time of the reboot, everything works normally for some days and the same error (also in event log) happens again.


      In a first step, I completely removed VirusScan and the agent via ePO and cleaned/removed registry and directories and re-installed everything again, but the error remains!


      Anybody else with this behaviour or errors or with a solution?


      Best regards,



      Message was edited by: diwi on 8/10/11 4:02:08 PM CEST
        • 1. Re: VSE 8.8.0 installed and Event ID 519 / Source mfehidk

          I am also facing the same issue in the servers where i deployed McAfee VSE 8.8. But this does not appear to happen in all the server. And also when this events starts occuring the Page fille memory shoots up and forces us to restart the server.

          Do anyone have the solution for this?

          • 2. Re: VSE 8.8.0 installed and Event ID 519 / Source mfehidk

            Hello raovi,


            good to know, that I am not alone with this problem. In the meantime I had contact with McAfee Gold Support and they told me, this happened to another Windows Server 2003 and they inofficially recommended me to use VirusScan 8.7 Patch 4 instead until Patch 1 for VirusScan 8.8.0 get released.


            This was something in my mind as well, so I decided to switch back again and wait for Patch 1 of VirusScan 8.8.0


            In the meantime the server is stable again with VSE870 Patch 4, so let's hope this is fixed in time.




            • 3. Re: VSE 8.8.0 installed and Event ID 519 / Source mfehidk

              hi diwi,


              Seems like only we are running on this side. Even i have logged a call with McAfee Gold support and they have not yet escalated it.

              Though rolling back to 8.7 patch4 solves the issue we want to know why VSE 8.8 is affecting only few servers.

              Just a fast question :-


              Did you face High memory usage during this error?


              Hope McAfee will come up with a better solution.





              • 4. Re: VSE 8.8.0 installed and Event ID 519 / Source mfehidk

                Hello Raovi,


                we did face countless errors in event logs and fragmented memory resulting in impossible logins. We had to restart the server again and again. Happened after 2, 3 or 4 days.

                We had 4 Windows Server 2003 installed with VSE880, 3 of them ran fine, 1 of them showed the above mentioned behaviour.


                And as McAfee did not have a solution atm, I decided to switch back until Patch 1, in which a lot of changes will be included.




                • 5. Re: VSE 8.8.0 installed and Event ID 519 / Source mfehidk

                  Thanks DIWI


                  i am still trying to escalate the issue with McAfee but they keep saying the details from MER tool is not enough for them

                  • 6. Re: VSE 8.8.0 installed and Event ID 519 / Source mfehidk



                    to diagnose my system seemed to be too much work for me and as long as I have my old ePO 3.6.1 I can handle the server via this ePO, where the old VirusScan 8.7 Patch 4 is checked-in, together with policies and tasks. The next try will be with patch 1 of VSE880 and if this is still problematic, I will check-in 8.7 Patch 4 into my new ePO 4.5.0 and let the server work there until Windows Server 2003 disappears on our systems.


                    I heard (from Gold Support) that VirusScan 8.8.0 uses different techniques to integrate into the system on Windows Server 2003 and Windows Server 2008, i.e. on Windows Server 2008 McAfee uses official API's and on Windows Server 2003 they use unofficial or own API's or something like that.


                    I wasn't able to deploy VirusScan 8.8.0 on a Windows 2000 server, though I installed ServicePack 4 and the SP4 Rollup Patch, so I had to reinstall 8.7 Patch 4 there as well. It's the last of hundreds of Windows Server still running this old operating system, but it's no real problem.


                    And VirusScan 8.7 is still supported, whereas VirusScan 8.5 won't be support beyong 31st of december 2011




                    • 7. Re: VSE 8.8.0 installed and Event ID 519 / Source mfehidk

                      We experience the same issue on some of our w2k3 servers.




                      • 8. Re: VSE 8.8.0 installed and Event ID 519 / Source mfehidk

                        Hello psolinski,


                        in this case, I would advise you to contact McAfee Support to let them know, that you experience this issue and maybe you could link this thread here. The more who report, the more McAfee is forced to find a solution.


                        Best regards,


                        • 9. Re: VSE 8.8.0 installed and Event ID 519 / Source mfehidk

                          Reported some time ago, now with Tier III

                          1 2 3 Previous Next