Event Source System mfehidk, ID 516, Level warning.

Process **\svchost.exe pid (996) contains signed but untrusted code, but was allowed to perform a privileged operation with a McAfee driver.

+ System
- Provider
[ Name] mfehidk
- EventID 516
[ Qualifiers] 33024
Level 3
Task 256
Keywords 0x80000000000000
- TimeCreated
[ SystemTime] 2011-08-22T01:03:45.980158800Z
EventRecordID 199879
Channel System
Computer PST-Ult-64-PC
Security
- EventData
\Device\mfehidk
**\svchost.exe
996
00000000030030000001000004020081000000000000000000000000000000000000000000000000

In Words

0000: 00000000 00300003 00000100 81000204
0008: 00000000 00000000 00000000 00000000
0010: 00000000 00000000

In Bytes

0000: 00 00 00 00 03 00 30 00 ......0.
0008: 00 01 00 00 04 02 00 81 .......
0010: 00 00 00 00 00 00 00 00 ........
0018: 00 00 00 00 00 00 00 00 ........
0020: 00 00 00 00 00 00 00 00 ........

 

Question Info


Last updated November 7, 2018 Views 7,029 Applies to:

Hi,

1.      When exactly do you get this error message?

2.      Did you make any changes to your computer?

3.      Did you check in event viewer to get this error message?

Have you installed McAfee software?

The issue is related McAfee software, I would suggest you to contact McAfee support center and check.

http://www.mcafee.com/us/support.aspx

Did this solve your problem?

Sorry this didn't help.

Great! Thanks for marking this as the answer.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this response?

Thanks for your feedback.

Hi Thanks,

1. I did not get message.
2. I unchecked some programs in Sys config to stop them starting during boot up with Windows.
3. Noticed this error in event viewer. It occurs late after boot up several times in a sequence.

Yes I have McAfee installed since last one year but no such error was seen.

With thanks
regards

Preetam Thakur.

Did this solve your problem?

Sorry this didn't help.

Great! Thanks for marking this as the answer.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this response?

Thanks for your feedback.

Hi,

1.      When exactly do you get this error message?

2.      Did you make any changes to your computer?

3.      Did you check in event viewer to get this error message?

Have you installed McAfee software?

The issue is related McAfee software, I would suggest you to contact McAfee support center and check.

http://www.mcafee.com/us/support.aspx


I get this error on our XP SP3 box approx every 15-60 minutes, according to the last 15 days of System Log in Event Viewer.

 

No changes to the computer.

 

This box runs McAfee Internet Security, and their Knowledge Base contains instructions to troubleshoot.

 

See McAfee KB71083, main troubleshooting KB for three related causes: https://kc.mcafee.com/corporate/index?page=content&id=KB71083

 

That said... following their instructions discovered the unsigned INDEX.DAT files are apparently created with a Microsoft-initiated process, and which may be associated with Internet Explorer 5 -- which was superceded on this system as IE6, IE7, and IE8 have been introduced.  The Process Explorer diagnostic (ref'd in McAfee KB71083) highlights these unsigned files:

 

SVCHOST (PID 1732)
index.dat C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat (Unable to verify) (null)
index.dat C:\Documents and Settings\NetworkService\Cookies\index.dat (Unable to verify) (null)
index.dat C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\index.dat (Unable to verify) (null)

 

SVCHOST (PID 1336)
INDEX.DAT C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\INDEX.DAT (Unable to verify) (null)
INDEX.DAT C:\Documents and Settings\LocalService\Cookies\INDEX.DAT (Unable to verify) (null)
INDEX.DAT C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\INDEX.DAT (Unable to verify) (null)

 

 haven't figured out a fix.  They were old, so I tried to simply delete.  No joy.  Couldn't delete as Administrator running Windows normally, due to being in use by another user or process.  Tried deleting in Safe Mode, seemed to work... but then each of the DATs were recreated with today's date after logging back into normal Windows.

 

-R44

 

Did this solve your problem?

Sorry this didn't help.

Great! Thanks for marking this as the answer.

How satisfied are you with this reply?

Thanks for your feedback, it helps us improve the site.

How satisfied are you with this response?

Thanks for your feedback.