On Windows 7, an attempt to automatically update BitTorrent Sync (BTSync) fails.
Occurrence
On the BTSync application one receives a notice that there is a newer version, and then clicks on the Update button.
A warning popup windows is displayed:
Unable to start updater process! Please download the newest version manually on .... Failed to launch exe C:\Users\.....AppData\Local\...\utt57AC.tmp.exe
Background
When this happens you may find an entry in the Windows Event Viewer management tool. Here is a snippet of the information in the log entry:
Log Name: Application Source: Microsoft-Windows-SoftwareRestrictionPolicies Level: Warning Description: Access to C:\Users\...\AppData\Local\Temp\utt57AC.tmp.exe has been restricted by your Administrator by location with policy rule ... placed on path C:\Users\...\AppData\Local\*\*.exe.
Fixes?
Add an exception to the Local Security Policy on the computer?
Nope. Many attack programs like the CryptoLocker Ransomware infection use the AppData\Local file path as temporary storage locations.
Manually install the new version?
Download the latest version manually from the BitTorrent Sync web site and install. It does keep any previous configurations.
Related Information
The virus is, of course, an executable attachment, but interestingly the icon representing the executable is a PDF file. With Windows’ hidden extensions feature, the sender simply adds “.pdf” to the end of the file (Windows hides the .exe) and the unwitting user is fooled into thinking the attachment is a harmless PDF file from a trusted sender. It is, of course, anything but harmless.
Links