License violation?

[AdaHacker]

We have two Gateway systems that are basically identical except for some user software. Both are running NT Workstation 4.0 build 1381 with service pack 6 and both are suffering from this really weird error. It's happened three times on one machine and once on the other. It pops up every few months and there doesn't seem to be any discernable pattern to it.

What happens is that the user will be working as normal - browsing the network, working on a spreadsheet, whatever - and this message pops up out of nowhere. The event viewer shows the following:
Application popup: System Process - License Violation : The system has detected tampering with your registered product type. This is a violation of your software license. Tampering with product type is not permitted.

After this, something happens to the registry and a whole bunch of system setting get blown away, including network settings and various user software settings.

Fixing the registry is straightforward enough, but it's annoying and time consuming, so I'd like to keep it from happening. The problem is, I can't seem to figure out what's causing this. The errors don't occur after software installations or configuration changes and nobody has done anything that could even remotely be construed as tampering with Windows. It just comes out of nowhere. Searches of Microsoft's web site have turned up nothing that looks useful. Does anyone have any ideas? I know it's not a lot to go on, but any suggestions would be appreciated.

 

[2ffat]

It sounds like something is trying to change your registry. It could be a virus, spyware, or a malformed program. First thing I would do is update your anti-virus signature (or get a AV program if you don't have one), and then download a anti-spyware program like Ad-aware (

http://www.lavasoftusa.com).

If those don't stop the problem, you may have to watch what is running in the background. Just my 2 cents worth. James P. Cottingham

I am the Unknown lead by the Unknowing.
I have done so much with so little
for so long that I am now qualified
to do anything with nothing.

 

[b5passat]

Disable auditing on HKEY_LOCAL_MACHINE registry key. Make sure that "Audit permissions on existing subkeys" is UNchecked. This is a known NT 4 bug. Matt

 

[AdaHacker]

Thank you both for responding!

Matt,
I ran across a knowledge base article on this as well. Problem is, registry auditing is disabled, at least as far as I can tell. I checked regedt32 and neither HKEY_LOCAL_MACHINE nor any of its immediate subkeys had anything checked at all. Unless there's some particular subkey deep in the registry that's causing it, I don't think this could be the problem.

James,
While I appreciate the suggestion, I don't think it's the answer. VirusScan turns up nothing (yes, our definitions are up to date) and I don't think it could be spyware. The users are both engineering aides who spend about 80% of their time in the field, and neither one has an internet account anyway, so it's unlikely that they could have inadvertently installed any such software. It also seems unlikely that the same or similar program would have ended up on both those computers but no others. If it was something that was getting passed around the office, I'd expect problems to show up on other machines.

Any other suggestions? At this point, I've just run out of ideas of thinks to check for.

 

[b5passat]

From how I understand the Technet article, it could very well be a buried registry key. I didn't look into the application of this very deeply, but is there an option like when applying permissions to replace all child objects? Matt