Warning Event ID 5603 Hosting Model property

[Guest]

This may be coincidence. 25 seconds after I updated my compaq presario
computer, (updated help and support with a sp file supplied by HP) i had the
following warning post in event viewer. ..

I went to hp online support to see if this was a byproduct of the update..
if so, I
was looking for info to handle the question of security violations mentioned
in the event. HP support said it wasn't part of my download/update. They
suggested it
might be spyware and to go to trendmicro, lavasoft and do the spyware "thing".

Has anyone seen this warning before? If so, how do I handle the security
part of the advise mentioned in event viewer?

I have gone to microsoft knowledge based files. I can not find any
reference to this
event.

I DID go to trendmicro's online spyware site, downloaded & ran the scan.
There was only one peer to peer file found. (winmx, which was a installation
file and has
never been accessed or otherwise touched besides the download 2 years ago)

I run Ad-Aware Plus SE (purchased). I updated definitions, ran the deep full
system scan. Got a persistent cookie logger 2o7.net -- nothing unusual, it
doesn't clean well -- I have showup often. It's been harmless (effectively)
in the past.

I've run hijack this. It looks ultra clean to me.

I'd appreciate some insight....if anyone has any. My exact warning event is
listed below.

Event Type: Warning
Event Source: WinMgmt
Event Category: None
Event ID: 5603
Date: 1/24/2006
Time: 12:21:25 AM
User: ADVENTURES\Owner
Computer: ADVENTURES
Description:
A provider, ScomProfiler, has been registered in the WMI namespace,
Root\Compaq, but did not specify the HostingModel property. This provider
will be run using the LocalSystem account. This account is privileged and
the provider may cause a security violation if it does not correctly
impersonate user requests. Ensure that provider has been reviewed for
security behavior and update the HostingModel property of the provider
registration to an account with the least privileges possible for the
required functionality.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

 

[Galen]

In Confused had this to say:

My reply is at the bottom of your sent message:

This may be coincidence. 25 seconds after I updated my compaq
presario computer, (updated help and support with a sp file supplied
by HP) i had the following warning post in event viewer. ..

I went to hp online support to see if this was a byproduct of the
update..
if so, I
was looking for info to handle the question of security violations
mentioned in the event. HP support said it wasn't part of my
download/update. They suggested it
might be spyware and to go to trendmicro, lavasoft and do the spyware
"thing".

Has anyone seen this warning before? If so, how do I handle the
security
part of the advise mentioned in event viewer?

I have gone to microsoft knowledge based files. I can not find any
reference to this
event.

I DID go to trendmicro's online spyware site, downloaded & ran the
scan. There was only one peer to peer file found. (winmx, which was a
installation file and has
never been accessed or otherwise touched besides the download 2 years
ago)

I run Ad-Aware Plus SE (purchased). I updated definitions, ran the
deep full system scan. Got a persistent cookie logger 2o7.net --
nothing unusual, it doesn't clean well -- I have showup often. It's
been harmless (effectively) in the past.

I've run hijack this. It looks ultra clean to me.

I'd appreciate some insight....if anyone has any. My exact warning
event is listed below.

Event Type: Warning
Event Source: WinMgmt
Event Category: None
Event ID: 5603
Date: 1/24/2006
Time: 12:21:25 AM
User: ADVENTURES\Owner
Computer: ADVENTURES
Description:
A provider, ScomProfiler, has been registered in the WMI namespace,
Root\Compaq, but did not specify the HostingModel property. This
provider will be run using the LocalSystem account. This account is
privileged and the provider may cause a security violation if it does
not correctly impersonate user requests. Ensure that provider has
been reviewed for security behavior and update the HostingModel
property of the provider registration to an account with the least
privileges possible for the required functionality.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

Probably inadvertently triggered by your HP update. Seems fairly benign
really?

http://eventid.net/display.asp?eventid=5603&eventno=4431&source=WinMgmt&phase=1

That's more information if you'd like.

--
Galen - MS MVP - Windows (Shell/User & IE)
http://dts-l.org/
http://kgiii.info/

"We approached the case, you remember, with an absolutely blank mind,
which is always an advantage. We had formed no theories. We were simply
there to observe and to draw inferences from our observations." -
Sherlock Holmes

 

[Guest]

Thank you Galen.

I WAS a bit stressed out about this event.
I feel much better now. It's sad to admit it but,
having computer stability ranks way up there with or maybe
a bit above love, happiness, looks and wealth in the overall
scheme of a good life !
Thanks !!