shock at first

[Guest ellas]

got a bit of a shock when I seen this message in xp's event viewer,

A provider, HiPerfCooker_v1, has been registered in the

WMI namespace to use the Local System Account. The

provider may cause a security violation if it does not

correctly impersonate user requests.

thought I had a trojan and did a full a/v scan, back on the internet found it to be a harmless m/s message,anyone else had this.

[Guest ellas]

heres the answer for anyone interested,

Unfortunately for the most part, Bill is right! :-)

Specifically about the comment that these are just trying

to tell you that someone of significance is happening, and

if you haven't installed new software, then you might want

to be concerned.

A lot of this came from us trying to move more and more

stuff out of privileged context on the system. We made a

big push to move lots of WMI provider stuff out of

localsystem into less privileged contexts. We did a lot of

reviews over core WMI providers that were left in the

system that still needed to run in priviledged context.

However, we started to throw these messages to alert that

there were still providers running in privileged context.

The message is not ideal, and is mostly due to the fact

that on our system right now, there's no clean way to

differentiate between debugging or "don't worry about me

unless you're having trouble" messages, and more important

messages. More specifically, as a component developer,

where do you throw these messages so there there when you

need them, but out of the way and not worrying people.

Net-net: in this case below, don't worry about them. In

the future the errors will continue to get better, and

this is just a transition. Sorry for the alarm. :-)

cheers,

-jasong

Jason Garms

Security Architecture Team

Security Business Unit