Software Restriction Policy on CC3

[Hightower]

I'm trying to update SIMS.net on a laptop, and I'm getting the error:

 

Access to C:\DOCUME~1\SYSTEM~1\LOCALS~1\Temp\GLB5.tmp has been restricted by your Administrator by location with policy rule {f8a64836-49e0-42a8-8036-310de3ec7f77} placed on path C:\Documents and Settings\systemadmin\Local Settings\Temp\*

 

in event viewer. This user account has, and is still, successfully updating SIMS.net on other machines. It just seems to be this machine. The funny thing is, I've tried manually creating a file in this location and it writes as expected.

 

Tried health checking policies/users/workstations, and obviously restarts. Anybody got any ideas before I commit to a rebuild?

[creese]

Have you run SimsPerm.bat???

[Hightower]

Yes - completes successfully, but still doesn't allow the updates to run, and produces same error in Event Viewer

[creese]

SupportNet is on a go sloooooooooooow, or stop. i'm sure in the recesses of my mind there is a solution to this.

[creese]

Still no SupportNet.

 

Does this path exist, it is similar to a path set in Sims.ini, it might be checking that.

[Hightower]

The path exists, however the file in the error does not exist. I can manually add a file (i.e. test.txt) to the path so that proves the user has write permissions on this area.

[creese]

Okay. I have done a search and it seems GLB5.tmp is Spyware.

[Hightower]

Just tried to install Spybot S&D on one of the problem machines and got a similar error:

 

Access to C:\DOCUME~1\SYSTEM~1\LOCALS~1\Temp\is-I6UE6.tmp\spybotsd162.tmp has been restricted by your Administrator by location with policy rule {f8a64836-49e0-42a8-8036-310de3ec7f77} placed on path C:\Documents and Settings\systemadmin\Local Settings\Temp\*

 

Same goes for trying to install MalwareBytes on the same machine:

 

Access to C:\DOCUME~1\SYSTEM~1\LOCALS~1\Temp\is-A2OJ8.tmp\MalwareBytes.tmp has been restricted by your Administrator by location with policy rule {f8a64836-49e0-42a8-8036-310de3ec7f77} placed on path C:\Documents and Settings\systemadmin\Local Settings\Temp\*

[creese]

I reckon that is your problem, malware firmly embedded in the system.

[Sylv3r]

If you haven't rebuilt it already perhaps a final "gpupdate /force" before you do.

[Hightower]

Well, I scanned the servers and they are all clean (phew). So I have just rebuild the offending machines (only three of them), and now everything is tickety boo.

 

Not sure it was Malware/Spyware, but a rebuild always does the trick with RM