Hi Friends,

I have a NT Server 4.0 with SP5 and IIS 4.0, MS PROXY SERVER 2.0,SQL SERVER 6.5,EUDORA WORLDMAIL 2.0 etc.

Today I got the following error messages on SERVER SCREEN

1)System process- License violation
The system has detected tampering with your registered product type.This is a violation of your software license.Tampering with product type is not permitted.
OK

2)Registery editor
Cannot import c:/winnt/profiles/ADMIN~1/desktop/server~1.reg.
Error writing to the registery.

After REBOOTING THE SERVER I got following problems.

1)Web site not functioning as WWW Service is stopped.
Error from SERVICES on control panel when manually starts WWW Service

"Could not start the World Wide publishing service on \\SERVER

Error 0006: The handle is invalid"

2)Event Viewer shows
The World Wide Web Publishing Service service terminated with the following error:
Invalid Signature.

The Microsoft SMTP Service service terminated with the following error:
Invalid Signature.

3)From MMC microsoft mgmt console, the proxy server components like web/winsock/sock proxy server has been removed.

4)SP5 rolled back to SP3 and RAS server has only 3 ports configured.(before that it has 8 ports configured)

How all this happened.Nothing new was installed on server.Anybody tried to HACK our SITE!!
(FTP,SOCKS SERVICES were stopped before)
How can I solve this pblm.

Thanking you all and Waiting for your valuable advice.

Joggy

Here is the answer to the license violation problem: Not sure about the rest but they maybe related.

PSS ID Number: Q260525
Article last modified on 05-02-2000

The information in this article applies to:

- Microsoft Windows NT Server version 4.0
- Microsoft Windows NT Workstation version 4.0
-------------------------------------------------------------------------------

SYMPTOMS
========

If you enable auditing on certain subkeys of the HKEY_LOCAL_MACHINE registry
key, the following error message may be displayed:

System Process - License Violation:
The system has detected tampering with your registered product type. This is a
violation of your software license. Tampering with product type is not
permitted.

This error message may appear multiple times if the "Audit permissions on
existing subkeys" check box is selected.

STATUS
======

This issue is resolved in Windows 2000.

MORE INFORMATION
================

The error message does not interfere with the auditing functions. Auditing still
occurs as expected.