We have a 50 workstation network license, and everything seems to be runing fine, when suddenly the AV symbol in the tray throws a dialog that it is closing. I open up KAV to see what's going on and the info window said the following...

4/29/2008 4:13:37 PM You have exceeded the maximum number of application copies that can be installed with this license key.

Followed by ...

4/29/2008 4:13:46 PM Update completed successfully

Then ...

4/29/2008 4:15:27 PM Protection of your computer started.

What gives? I had KAV off temporarily as it kept interfering with the Network delivery setup of AutoDesk AutoCad Civil 3D 2009 which I believe was a false positive...

4/29/2008 1:57:48 PM Running process C:\WINDOWS\TEMP\_AIA.TMP\SETUP.EXE: detected modification of riskware 'Worm.generic'.
4/29/2008 1:57:49 PM Process C:\WINDOWS\TEMP\_AIA.TMP\SETUP.EXE (PID: 2808): "Terminate process" action chosen

The license error happened about 14 minutes after I turned KAV back on.

According to my event log, this license thing happened again last week.

The program also deleted one of my dll's that was part of my PowerDVD program that I also believe was a false positive.

4/23/2008 12:17:03 PM File C:\Program Files (x86)\CyberLink\PowerDVD DX\fwnet.dll: detected Trojan program 'Trojan-Downloader.Win32.Zlob.lps'.
4/23/2008 12:17:03 PM Security threats have been detected. You are advised to neutralize them immediately.
4/23/2008 12:17:03 PM File C:\Program Files (x86)\CyberLink\PowerDVD DX\fwnet.dll: is still infected, cannot be disinfected.
4/23/2008 12:17:05 PM File C:\Program Files (x86)\CyberLink\PowerDVD DX\fwnet.dll: deleted.

What's going on?

Hi,

Regarding those two files, if they are still being flagged you could send them in a zip/rar archive to newvirus@kaspersky.com with "Possible false positive" in the message subject/body and it should be corrected shortly if it is indeed a false detection.


I know it sounds strange, but was there any temporary change of date just before KAV gave the license error message?

I forwarded the dll file as you suggested. Regarding the license error message, I don't show anything in my Windows logs at that time. I wasn't adjusting the time/date at the point where it threw an error about the license.

Thanks

Hello,

I faced the same detection, I can confirm to you that it was a false positive (last week). Update your antivirus database and perform a full scan.

Concerning the license error message, how many network adapters are set on this computer ? Please paste the result of the following command : ipconfig / all.
Also try to disable network adapters which are not used.

Regards,
D.

Here's the list as requested...

Microsoft Windows [Version 6.0.6001]
Copyright © 2006 Microsoft Corporation. All rights reserved.

C:\Windows\system32>ipconfig /all

Windows IP Configuration

Host Name . . . . . . . . . . . . : XXX
Primary Dns Suffix . . . . . . . : XXX.XXX
Node Type . . . . . . . . . . . . : Hybrid
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No
DNS Suffix Search List. . . . . . : XXX.XXX

Ethernet adapter Bluetooth Network Connection:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Bluetooth Device (Personal Area Network)
Physical Address. . . . . . . . . : 00-1A-6B-E5-F3-84
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes

Ethernet adapter Local Area Connection:

Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Broadcom NetXtreme 57xx Gigabit Controlle
r
Physical Address. . . . . . . . . : 00-1C-23-0E-53-6A
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
Link-local IPv6 Address . . . . . : fe80::ec84:10f6:65df:b71e%11(Preferred)
IPv4 Address. . . . . . . . . . . : 192.168.1.150(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Lease Obtained. . . . . . . . . . : Thursday, May 01, 2008 7:52:54 AM
Lease Expires . . . . . . . . . . : Friday, May 09, 2008 7:52:56 AM
Default Gateway . . . . . . . . . : 192.168.1.100
DHCP Server . . . . . . . . . . . : 192.168.1.27
DNS Servers . . . . . . . . . . . : 192.168.1.27
192.168.1.25
Primary WINS Server . . . . . . . : 192.168.1.27
NetBIOS over Tcpip. . . . . . . . : Enabled

Wireless LAN adapter Wireless Network Connection:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Dell Wireless 1505 Draft 802.11n WLAN Min
i-Card
Physical Address. . . . . . . . . : 00-1C-26-CB-6F-43
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes

Tunnel adapter Local Area Connection* 6:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : isatap.{2F51C214-EF3C-4F27-A1D0-74F89B713
E58}
Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes

Tunnel adapter Local Area Connection* 7:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Teredo Tunneling Pseudo-Interface
Physical Address. . . . . . . . . : 02-00-54-55-4E-01
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes

Tunnel adapter Local Area Connection* 15:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : isatap.{E3D9A567-B5BF-4930-8E13-E76CFE7F3
7F5}
Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes

Tunnel adapter Local Area Connection* 14:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : isatap.{F5F94E89-3673-4AB1-B477-6F9257CC5
E5C}
Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes

C:\Windows\system32>

Well as I thought because you have several network connections configured, KAV think they belong to others computers and that the current license key is used several times, this is a bug.

Try to disable unused network connexions (Bluetooth, tunnels, ...)

Is this bug slated to be fix in a soon-to-be-released patch of some sort? If so, when is it slated for release?

I'm getting this as well on my new Vista machine. Annoying...
on 6.0.837 of Kaspersky...