3 Replies Latest reply on Jan 3, 2017 10:44 AM by tao

    Event ID 514

    dingoberry

      Could you someone please tell me what is exactly causing this warning message and how can I resolve it? In our environment we are currently using the the latest and greatest VSE 8.8 with Patch 5 installed.

       

      Type:Warning
      Source:mfehidk
      Event ID:514
      Event Time:6/2/2015 5:15:02 PM
      User:n/a
      Computer:XXXXXXX

      Description:

      Process **\McScript_InUse.exe pid (4008) contained unsigned or corrupted code and was blocked from performing a privileged operation with a McAfee driver.

        • 1. Re: Event ID 514
          wwarren

          It means the process shown in the event (**\McScript_InUse.exe, in your case) is loading untrusted code. Code that isn't from McAfee or Microsoft.

          It could be malware. It probably isn't, but it could be, we don't know - all we know is there is foreign code loading into one of our processes and it could be doing bad things and going unnoticed.

          It's kind of important to find out what that foreign code is, which is why we create these events, hoping you'll investigate.


          Look at KB74296 for more info.

          • 2. Re: Event ID 514
            mark.kerr@uk.fujitsu.com

            The link above no longer works is there a replacement KB Article for KB74296

            • 3. Re: Event ID 514
              tao

              Related Information

              NOTE: Content from unpublished KB73354 and KB74296 have been incorporated into this article.

               

              Event ID 514/516/519, Warning, Process **\VSTSKMGR.EXE pid (XXXX) contains signed but untrusted code (issue: third-party application DLL) Technical Articles ID:   KB74176 Last Modified:  03-11-2016

              McAfee Corporate KB - KB74176