mfehidk "warning" event-ID 516 referring to MCSHIELD.EXE, MCSVHOST.EXE and a McAfee-Driver - Potential Fix

[Dazman]

I posted this in another Thread on this forum also just wanted to get visibility in case it works for you... I appear to have found a fix for this issue on my Windows 7 X64 Ultimate install with the 2010 BT Netprotect verion of Mcafee Antivirus.  I found a reference to a McAfee utility in the Knowledge base for an issue with PCPeople. I figured the issue must be caused by an install issue so I looked for a way to install the driver again.   The solution was to run mfehidin.exe to install MFEHIDK.sys from the command line with the command "mfehidin.exe -i mfehidk.sys".  mfehidin.exe resides in my c:\program files\common files\mcafee\vscore directory along with the MFEHIDK. inf, cat and sys files so you have to change directory on the command line to "cd c:\program files\common files\mcafee\vscore and then run the mfehidin.exe -i mfehidk.sys command.  For other operating systems it may be in another place so you will have to search your McAfee program file directories to be sure.  Then type "mfehidin.exe -i mfehidk.sys" (no quotes) into the command line and press enter.  An alternative method that might work would be to right click on mfehidk.inf and select install from the popup window. This should install the driver again using the security catalog information contained in mfehidk.cat which is where I think McAfee got the install process wrong as it does not appear to register the security catalog details when installing the driver.  After I did this I got a windows automatic certificate update for a Digicert SSL Certificate but I do not know if this was related.  I have not got this error since doing this.  Of course you mileage may vary!  Good luck and let me know if it works for you.  Daz.

[tomica]

Thanks for the mail. I haven't tried your idea yet - the "mfehidk "warning" 
event-ID 516 doesn't appear so often any more - only about 6 times per  day.

Best regards

[zipperhead357]

No, was never resolved. I gave up as I could not deal with the tech support any longer. If you were to call McAfee right now and report this problem, they would take you through the same steps as I described and you will reach the same conclusion, i.e. you wasted your time.

[rohe1318]

I just started getting a similar error message on my Dell desktop running XP SP3 and VirusScan 2010. It looked like there was an attempted automatic update around that time yesterday.

Event Type: Warning
Event Source: mfehidk
Event Category: (256)
Event ID: 516
Date:  1/1/2011
Time:  6:06:07 PM
Process **\MCUPDMGR.EXE pid (3852) contains signed but untrusted code, but was allowed to perform a privileged operation with a McAfee driver.
Data:
0000: 00 00 00 00 03 00 58 00   ......X.
0008: 00 01 00 00 04 02 00 81   .......
0010: 00 00 00 00 00 00 00 00   ........
0018: 00 00 00 00 00 00 00 00   ........
0020: 00 00 00 00 00 00 00 00   ........

From what I read here, there doesn't seem to be an explanation or a fix.

Before I found this thread, I tried to start an on-line chat with McAfee support but got an error message saying the software for the chat session failed to start.

Ron

[Alaskan]

I have a brand spanking new Dell XPS 7100, 6 Core AMD CPU, 8GB Ram and I've been seeing this error since I first powered up the computer.

I am running widows 7 pro (64bit) and mcafee.  Unless McAfee gets off their duff and fixes this I'll be removing all traces of their product and going with something else like AVG or Avast (I've never had issues with either of those products)

I have not noticed any issues although my system does seem slow to start up and run applications. I thought maybe this was mcafee but blew it off but I'm now not so sure and will dig deeper. This was a reason why I started telling my customers not to use mcafee, because it caused systems to slow to a crawl that should otherwise run 100 of times faster. (don't get me started on styme-mantic)

I thought maybe it was time to give McAfee another shot but this is unacceptable, Over a month and no response back from McAfee support on this? !!

Message was edited by: Alaskan on 1/19/11 2:11:19 PM CST

[pralamo]

I've got the same problem.

W7 64 bits, Mcafee ISS.

Process **\MCSVHOST.EXE pid (1800) contains signed but untrusted code, but was allowed to perform a privileged operation with a McAfee driver.

evento 516.

I have just re-instaled the program.

   1. Uninstalling all McAfee products (inc MVT) via Control Panel

   2. Running McAfee's uninstaller

   3. Rebooting

   4. Running CCleaner (which found a few registry entries left by McAfee Uninstaller)

   5. Reinstalling the product

Doesn't work

I tried the command " mfehidin.exe -i mfehidk.sys "   (Only works for a while.....)

i'm tired about this......

No solutions then???????????????????

[exbrit]

Open a case, again if necessary, with Technical Support Chat and ask them to escalate it.  If there are previous cases quote the reference number.

Linked under Useful Links at the top of this page.

Message was edited by: Ex_Brit on 29/01/11 6:22:08 EST AM

[pralamo]

Well...

In fact, I'd already opened a case with Technical Support Chat.

The Technical Support updated my windows 7 and........   no more.....

Just updating windows doesn´t repair the problem...

re-instalating software doen't work.....

"mfehidin.exe -i mfehidk.sys" doesn't work......

????????????

Thanks for the replies

[exbrit]

I've asked the McAfee person who was in the thread earlier to take a look.

[pralamo]

anyone else with the same warning?

I'm loking for a solution or an explanation........

No idea.

Thanks in advance