WTF?!?!
Published on June 19, 2014 By Daiwa In Personal Computing

Logged on to my laptop this afternoon and a popup appeared in the lower right corner of the desktop labeled "Magic Barrage".


Text below it was "Get Gift"

"Enjoy Game"

"Win Confidence"

And a button labeled "Play Now".

Which of course I'm not clicking.

 

Anyone know what this is and what process it might be associated with?  Nothing in Task Manager seems to match it.  MalwareBytes didn't identify a problem.


Thanks


Comments (Page 1)
on Jun 19, 2014

https://duckduckgo.com/?q=magic+barrage

 

Daiwa, did a grandchild have access to the laptop...mayve visit a game site? Or maybe you installed some software and got a present with it? [I don't really think that...you're very careful].

The link is a duckduckgo search result. It appears to be a 'shoot 'em up' game (http://magicbarrage.r2games.com/).

I would just uninstall it using CCleaner.

on Jun 19, 2014

Thanks, Doc.  I ducked it, too.  Nothing about it being clickbait but I'm the cautious type - has no business being there when I log on.  Never visited any game sites, don't think any tagalongs got by me (haven't installed anything new recently, only security updates and the every-other-day Flash updates).  Grandkids are here but they don't have the PW (encrypted machine).

MWB turned up nothing.  Running Bitdefender scan now.  No process I can identify to kill.  Hate this crap.

on Jun 19, 2014

Have you got "Advanced System Care" from Iobit ?? 


http://www.sevenforums.com/software/335246-magic-barrage-deletion-2.html


http://nerdanswer.com/answer.php?q=601179


Basically,I don't trust software from China though,it happened and often being piggybacked with malicious files from its update servers.

on Jun 19, 2014

I , and several others here, use IOBIT Advanced System Care with Antivirus and GameBooster3 and can assure you it is ok, and not your culprit.

on Jun 20, 2014

Gaspershooters -

Thanks for the tip - that was apparently it.  As it happens, I ended up with ASC installed by stealth once a few months ago when I installed Smart Defrag.  One of the reasons I ended up ditching it - I don't like that sort of behavior.  Uninstalled with Revo but even Revo didn't get rid of this little gem.

Found updatepackasc.exe in C:/Users/{username}/AppData/Local/Temp and a copy of it in Prefetch.  It had a file creation date of 6-19-14 so I presume the Iobit remnant app which generated it had a date trigger.

Then found two Iobit folders remaining in C:/Users/{username}/AppData/LocalLow and another Iobit folder in C:/Users/{username}/AppData/Roaming.

Needless to say, deleted them all.  I was pretty pissed at Iobit's behavior previously and with problems encountered with the version 3 update of Smart Defrag, but now I despise them for their intrusiveness.  Cost me a full half day of work today, the bastards (wasn't about to do anything on my rig until I 'cleared' this issue).  Wouldn't trust anything from them or their 'partners' and would consider their products to be malware.  YMMV

EDIT -  I've calmed down a bit now.  The malware accusation was probably uncalled for but I would still be cautious with their products.

 

on Jun 20, 2014

RedneckDude

and several others here...........

 

That contradicted what's said on above 2 links,isn't it?? Once got Flashget,-a file downloader tool from China-it got contaminated from its update files on server which no official confirmation/reply after news break out that certain amounts of users have some quirky behaviors on their ends.    

on Jun 20, 2014

Sorry, RND - have to disagree with you on this one.  This looks pretty clearly to be an Iobit leftover - the 'asc' in updatepackasc.exe.  I regret I didn't verify the source by checking the file's properties dialog before deleting it, but I think my conclusion is correct.

on Jun 20, 2014

RedneckDude
I , and several others here, use IOBIT Advanced System Care with Antivirus and GameBooster3 and can assure you it is ok, and not your culprit.

I've not had issues with IObit products installing game installers or popups, but then I always download and update via the official website.  However, I have heard of people getting additional crap they neither asked for or wanted when they downloaded packages that were bundled with other crap through sites such as C-Net and the like.... some of that stuff has no opt out, so I've heard.

on Jun 20, 2014

With all IObit products when you do the install your should click on custom install and uncheck the bloat that comes with them. Spigot toolbar, change search provider and another toolbar. I've not had a problem with ASC since I first started using it. ASC is the only one I have left. I got rid of MSE and Threatfire and installed Avast free version. Works so much better. 

on Jun 20, 2014

ASC has served me well, with no adverse side effects. All I can report is my experience. Wiz will say the same, he uses it as well. The one with built in anti virus.

Same goes for Game Booster 3. Game Booster 4 is problematic.

I use SSDs so I have no need for Smart Defrag.

on Jun 20, 2014

RedneckDude
ASC has served me well, with no adverse side effects.

As I said, YMMV.  It may well be that the delayed popup only occurs if you uninstall the application.

Celennax
Try running a antivirus.

Did, and turned up nothing.  You stuck a link to hackerbot in my quoted text - not cool, whoever you are.

 

Popup has not recurred with two subsequent logons since deleting updatepackasc.exe, FWIW.

on Jun 20, 2014

Thank you, Jafo.  Had a feeling.

on Jun 20, 2014

Thank you, Jafo. Had a feeling.

Wasn't me....I was Friday night red-wining ...

...but I'll take the credit all the same...

on Jun 21, 2014

Whoever it was, that reply was gone in less than 5 minutes it seemed.  Disappeared in the time it took to compose my brief reply, anyway.  Nice work.  Pass along the thanks.

on Jun 22, 2014

The problem came when IOBit's "partner, Magic Barrage" "accidentally" sent the popup. I had ASC Pro on my machine, and killing the updatepasc process caused the popup to disappear. IO Bit customer support advised that they had notified Magic Barrage about the problem, and apparently others no longer get the popup.

When the malware program I used actually installs malware, I'm not able to trust it. If it was free, I might feel a little more forgiving, but this is a paid subscription!

I've deleted ASC Pro, but it fights like a virus to stay installed. The uninstall leaves enough behind that some parts still run.