Identify trust issues when the System Event Log reports Event ID 514, 516, or 519

Technical Articles ID: KB87795
Last Modified: 2023-03-17 04:32:32 Etc/GMT

Environment

Application and Change Control 8.x, 7.x, 6.x
Data Exchange Layer 6.x, 5.x
Data Loss Prevention Endpoint 11.x
Endpoint Intelligence Agent 3.x, 2.x
Endpoint Security 10.x
Trellix Agent 5.x

SysCore 15.3 or later

Summary

This article describes how to use the built-in SysCore utility VtpInfo. You use this utility to determine the trust state of a module or process when you're troubleshooting issues where the System Event Log reports Event ID 514, 516, or 519.

The VtpInfo command determines whether Trellix trusts a module (DLL or EXE) or process (EXE). If a process isn't trusted, the command output identifies which components are the cause.

Problem

The Windows System Event Log reports multiple entries for Event ID 514, 516, or 519 similar to the following:

Event Type: Warning
Event Source: mfehidk
Event Category: (256)
Event ID: 514
Description:
Process C:\Program Files\McAfee\VirusScan Enterprise\ pid (###) contained unsigned or corrupted code and was blocked from performing a privileged operation with a McAfee driver

Event Type: Warning
Event Source: mfehidk
Event Category: (256)
Event ID: 516
Description:
Process **\VSTSKMGR.EXE pid (XXXX) contains signed but untrusted code, but was allowed to perform a privileged operation with a McAfee driver

Event Type: Warning
Event Source: mfehidk
Event Category: (256)
Event ID: 519
Description:
Process **\VSTSKMGR.EXE pid (####) could not be successfully validated with the mfevtp service and was blocked from performing a privileged operation with a McAfee driver

Event Type: Warning
Event Source: mfehidk
Event Category: (256)
Event ID: 514
Description:
Process **\OUTLOOK.EXE pid (###) contained unsigned or corrupted code and was blocked from performing a privileged operation with a McAfee driver

On some systems, the event is logged every few minutes.

No other symptoms are reported on the client.

IMPORTANT: Product function and performance aren't impacted.

Solution

Use the VtpInfo tool to determine the trust state of a file on disk or of a running process. Use the following commands from an elevated command prompt:

vtpinfo.exe /validatemodule "<full path to DLL or EXE>"

vtpinfo.exe /validateprocess <process ID (PID) that the application is running as>

To save a file with the trust status information for the module or process, run the following commands from an elevated command prompt:

NOTE: Make sure the directory C:\Temp\ exists before running the command or it fails. The command doesn't create the target directory.

"C:\Program Files\Common Files\McAfee\SystemCore\vtpinfo.exe" /validatemodule "<full path to DLL or EXE>" >C:\Temp\vtpinfo.txt

"C:\Program Files\Common Files\McAfee\SystemCore\vtpinfo.exe" /validateprocess <PID that the application is running as> >C:\Temp\vtpinfo.txt

Review the file vtpinfo.txt. Determine what's trusted or untrusted in the specified module or process. All modules loaded into the process being queried are listed in the results with their trust status. In the end of the file, the aggregate result displays. If you see validation_state= VALIDATION_STATE_INVALID or privileges= PRIVILEGE_NONE, the module or process isn't trusted.

After you identify the untrusted module or process, contact the vendor to determine how to prevent the binary from injecting into Trellix software.

Affected Products

Languages:

This article is available in the following languages:

Knowledge Center

Identify trust issues when the System Event Log reports Event ID 514, 516, or 519

Environment

Summary

Problem

Solution

Affected Products

Languages:

Title

Title

Knowledge Center

Identify trust issues when the System Event Log reports Event ID 514, 516, or 519

Environment

Summary

Problem

Solution

Affected Products

Languages:

Choose your region

Title

Title