mfehidk "warning" event-ID 516 referring to MCSHIELD.EXE, MCSVHOST.EXE and a McAfee-Driver

[adrianrp]

Just for the record I solved this by:

   1. Uninstalling all McAfee products (inc MVT) via Control Panel
   2. Running McAfee's uninstaller
   3. Rebooting
   4. Running CCleaner (which found a few registry entries left by McAfee Uninstaller)
   5. Reinstalling the product

[kmbrite]

I have the same problem on 2 xp pro systems.  I have reinstalled about 3 times on each computer that is affected to no avail.  I have:

1. removed all mcafee software with the add/remove programs

2. downloaded a new mcpr.exe each time and had "successful" removal

3. rebooted

3. removed traces of mcafee aps remaining

4. run ccleaner

5. redownloaded and installed mcafee product (just av and firewall)

6. Still have this error right after installing:

Event Type: Warning

Event Source: mfehidk
Event Category: (256)
Event ID: 516
Date:  8/30/2010
Time:  9:08:46 PM

Process **\MCSHIELD.EXE pid (2504) contains signed but untrusted code, but was allowed to perform a privileged operation with a McAfee driver.

There are 17 instances of this in my event viewer since install.....GRRRRRRRRRRRRRRRRRRRRRRRRR!!!!!!!!!!!!!!!!!!!!

I have also spent 2 hours on a Sunday trying to solve this with a Mcafee Tech with no resolution.  I noticed that there are 2 mfehidk.sys files.  If you uninstall Mcafee they both disappear.

The one in C:\WINDOWS\system32\drivers is version 14.2.0.903

created: Monday, May 31, 2010, 8:32:58 PM

modified: Monday, May 31, 2010, 8:32:58 PM

accessed: Today, August 30, 2010, 9:18:47 PM

The one in C:\Program Files\Common Files\Mcafee\VSCore is version 14.2.0.903

created: Today, August 30, 2010, 8:27:46 PM

modified: Monday, May 31, 2010, 8:32:58 PM

accessed: Today, August 30, 2010, 8:27:46 PM

One of my computers is a wireless laptop and this error slows it down.  I have had the error ever since installing a new mcafee version when my subscription ran out in May.  The previous version never had this problem!!!!  I want a fix!  We all deserve a fix!!!!

Message was edited by: kmbrite on 8/30/10 9:38:58 PM CDT

[adrianrp]

Whoops.... maybe I should have read the original post more carefully.

Error I had was this:

Event Source mfehidk
Event Category 256
Event ID 516
Description
Process \MCUPDMGR.EXE pid 2284 contains signed but untrusted code, but was allowed to perform a privileged operation with a McAfee driver.

So mine was different - MCUPDMGR rather than MCSHIELD

Perhaps this is why mine was fixed.

FYI just to be double sure I even removed the McAfee items from the Windows Prefetch folder before reinstalling, but this should not make any difference.

[tomica]

I'm "glad" to see other users becoming involved. I wish someone at McAfee would read these comments and provide a patch. Someone suggested to me that it could have something to do do with Microsoft certification. Interestingly enough, I've not seen the problem addressed in any computer magazine.

[kmbrite]

I noticed this error after install in May, but usually ignore things for a while.  I tried to troubleshoot it myself for a long time.  The laptop runs much slower wih McAfee installed.  In fact the desk top that has the same problem runs slower too.  I have removed the program from the laptop. It appears no one at McAfee is interested in telling their customers what this is.  The error has been going on too long and I think they do know how to fix it.  I am going to seek some other firewall/av solution.  McAfee only seems interested in whether you have the right amount of computers running on your licence and the techs do not really troubleshoot your computer.

[tomica]

I tend to agree, although I can't say I've noticed any slowing down om my Vista PC. My XP computer does not have the problem.

[kmbrite]

Here's a new wrinkle, mcafee has deactivated itself on the xp desktop that was still running the program.  It will not reactivate or allow me to even turn it off.  When this happened, the program indicated that it had been updated.  I will post later to say if this is another error problem or the beginning of a fix.  Looks like I may have to reinstall again!

[kmbrite]

Well, the mfehidk.sys error is still there after another reinstall.  Furthermore, the program deactivated itself after I had it all done.  I had to "chat" with a tech to fix it.  It appears to be working at this moment. Even though my subscription was valid and the website allowed me to download and install it, I think they deliberately deactivated it.  ( I have reinstalled my program many times due to to "mfehidk event 516".)  This necessitated my having to spend more time so they could verify my computer....ect.   I did not allow the tech to access the computer.  All I did was right click on the Mcafee icon in the systray, click reactivate...sends you to your user account center to login.  Then I logged in and was told by the tech to check for updates.  Then the program was activated.  This process is abuse!  I don't know what I will do with this desktop yet.  I may just install the FREE microsoft programs and to heck with it!  If  I see a fix I will post.

[sonofanarchy]

I have the same problem...

about 60 logs in the event viewer a day for a few months.

I also hear an annoying mouse click sound when the event is logged.

XP Home SP3

P4 3.00GHz custom build

2.50 GB Ram

Process **\MCSHIELD.EXE pid (1636) contains signed but untrusted code, but was allowed to perform a privileged operation with a McAfee driver.

0000: 00 00 00 00 03 00 58 00   ......X.
0008: 00 01 00 00 04 02 00 81   .......
0010: 00 00 00 00 00 00 00 00   ........
0018: 00 00 00 00 00 00 00 00   ........
0020: 00 00 00 00 00 00 00 00   ........

[kmbrite]

I bought a bigger hard drive for my laptop and decided to reinstall windows xp rather than restoring from an image.  Wth just windows xp installed and updated and microsoft office xp updated, I am getting the mfehidk event 516 in my log.  So it looks like the latest mcafee antivirus plus program isn't compatable with windows xp pro sp3 updated and microsoft office xp updated.