Magic Barrage Popup

WTF?!?!

Logged on to my laptop this afternoon and a popup appeared in the lower right corner of the desktop labeled "Magic Barrage".


Text below it was "Get Gift"

"Enjoy Game"

"Win Confidence"

And a button labeled "Play Now".

Which of course I'm not clicking.

 

Anyone know what this is and what process it might be associated with?  Nothing in Task Manager seems to match it.  MalwareBytes didn't identify a problem.


Thanks

104,292 views 26 replies
Reply #1 Top

https://duckduckgo.com/?q=magic+barrage

 

Daiwa, did a grandchild have access to the laptop...mayve visit a game site? Or maybe you installed some software and got a present with it? [I don't really think that...you're very careful].

The link is a duckduckgo search result. It appears to be a 'shoot 'em up' game (http://magicbarrage.r2games.com/).

I would just uninstall it using CCleaner.

Reply #2 Top

Thanks, Doc.  I ducked it, too.  Nothing about it being clickbait but I'm the cautious type - has no business being there when I log on.  Never visited any game sites, don't think any tagalongs got by me (haven't installed anything new recently, only security updates and the every-other-day Flash updates).  Grandkids are here but they don't have the PW (encrypted machine).

MWB turned up nothing.  Running Bitdefender scan now.  No process I can identify to kill.  Hate this crap.

Reply #4 Top

I , and several others here, use IOBIT Advanced System Care with Antivirus and GameBooster3 and can assure you it is ok, and not your culprit.

Reply #5 Top

Gaspershooters -

Thanks for the tip - that was apparently it.  As it happens, I ended up with ASC installed by stealth once a few months ago when I installed Smart Defrag.  One of the reasons I ended up ditching it - I don't like that sort of behavior.  Uninstalled with Revo but even Revo didn't get rid of this little gem.

Found updatepackasc.exe in C:/Users/{username}/AppData/Local/Temp and a copy of it in Prefetch.  It had a file creation date of 6-19-14 so I presume the Iobit remnant app which generated it had a date trigger.

Then found two Iobit folders remaining in C:/Users/{username}/AppData/LocalLow and another Iobit folder in C:/Users/{username}/AppData/Roaming.

Needless to say, deleted them all.  I was pretty pissed at Iobit's behavior previously and with problems encountered with the version 3 update of Smart Defrag, but now I despise them for their intrusiveness.  Cost me a full half day of work today, the bastards (wasn't about to do anything on my rig until I 'cleared' this issue).  Wouldn't trust anything from them or their 'partners' and would consider their products to be malware.  YMMV

EDIT -  I've calmed down a bit now.  The malware accusation was probably uncalled for but I would still be cautious with their products.

 

Reply #6 Top

Quoting RedneckDude, reply 4

and several others here...........
End of RedneckDude's quote

 

That contradicted what's said on above 2 links,isn't it?? Once got Flashget,-a file downloader tool from China-it got contaminated from its update files on server which no official confirmation/reply after news break out that certain amounts of users have some quirky behaviors on their ends.    

Reply #7 Top

Sorry, RND - have to disagree with you on this one.  This looks pretty clearly to be an Iobit leftover - the 'asc' in updatepackasc.exe.  I regret I didn't verify the source by checking the file's properties dialog before deleting it, but I think my conclusion is correct.

Reply #8 Top

Quoting RedneckDude, reply 4
I , and several others here, use IOBIT Advanced System Care with Antivirus and GameBooster3 and can assure you it is ok, and not your culprit.
End of RedneckDude's quote

I've not had issues with IObit products installing game installers or popups, but then I always download and update via the official website.  However, I have heard of people getting additional crap they neither asked for or wanted when they downloaded packages that were bundled with other crap through sites such as C-Net and the like.... some of that stuff has no opt out, so I've heard.

Reply #9 Top

With all IObit products when you do the install your should click on custom install and uncheck the bloat that comes with them. Spigot toolbar, change search provider and another toolbar. I've not had a problem with ASC since I first started using it. ASC is the only one I have left. I got rid of MSE and Threatfire and installed Avast free version. Works so much better. 

Reply #10 Top

ASC has served me well, with no adverse side effects. All I can report is my experience. Wiz will say the same, he uses it as well. The one with built in anti virus.

Same goes for Game Booster 3. Game Booster 4 is problematic.

I use SSDs so I have no need for Smart Defrag.

Reply #11 Top

Quoting RedneckDude, reply 10
ASC has served me well, with no adverse side effects.
End of RedneckDude's quote

As I said, YMMV.  It may well be that the delayed popup only occurs if you uninstall the application.

Quoting Celennax, reply 11
Try running a antivirus.
End of Celennax's quote

Did, and turned up nothing.  You stuck a link to hackerbot in my quoted text - not cool, whoever you are.

 

Popup has not recurred with two subsequent logons since deleting updatepackasc.exe, FWIW.

Reply #12 Top

Thank you, Jafo.  Had a feeling.

Reply #13 Top

Quoting Daiwa, reply 12
Thank you, Jafo. Had a feeling.
End of Daiwa's quote

Wasn't me....I was Friday night red-wining ...;)

...but I'll take the credit all the same...;)

Reply #14 Top

Whoever it was, that reply was gone in less than 5 minutes it seemed.  Disappeared in the time it took to compose my brief reply, anyway.  Nice work.  Pass along the thanks.

Reply #15 Top

The problem came when IOBit's "partner, Magic Barrage" "accidentally" sent the popup. I had ASC Pro on my machine, and killing the updatepasc process caused the popup to disappear. IO Bit customer support advised that they had notified Magic Barrage about the problem, and apparently others no longer get the popup.

When the malware program I used actually installs malware, I'm not able to trust it. If it was free, I might feel a little more forgiving, but this is a paid subscription!

I've deleted ASC Pro, but it fights like a virus to stay installed. The uninstall leaves enough behind that some parts still run.

Reply #16 Top

I've deleted ASC Pro before using ASC's uninstaller. It takes out everything leaving nothing behind. Never a problem there. I'm running the Pro version again when it was a give away with a lifetime license.

Reply #17 Top

I use ASC Pro, Malware Fighter and Smart Defrag and have never had the problems you folks are describing.  I don't doubt you but it does seem somewhat strange that it isn't happening to all users of the software.  This seems to be the basic problem when it comes to discussing computer problems, why do only some folks have them and others using the same software don't. 

It would seem that some things is life are destined to remain a mystery.    :-"

Reply #18 Top

Can't agree more philly.

Reply #19 Top

Quoting Philly0381, reply 17


It would seem that some things is life are destined to remain a mystery.   
End of Philly0381's quote

 

No,it didn't;it's a misconduct perpetrated by a company which has been flagged by Malwarebytes as bully to consumers. Just searched "updatepackasc.exe",it got all over the places,included Japanese users.  

Base on this article: http://thewebatom.net/blog/iobit-is-a-sucky-company/ ,I wouldn't trust it no matter how many users claimed they are using fine. Well,that's your luck,maybe next time. 

For those need help to remove the darn pop-up,here is the tutorial:

https://forums.malwarebytes.org/index.php?/topic/151042-need-help-removing-updatepackascexe-installed-by-iobit-uninstaller-update/?p=843942

Reply #20 Top

I apologize Gaspershooters, I didn't mean or want to diminish that fact you and others are having a problem, just stating that others are not and that it was pretty much how computer problems goes, no rhyme or reason.  I'm not all that sure though that luck is involved.   :sun:

Reply #21 Top

I never got that pop up but...from what I've read in several links using Google the updatepackasc.exe although listed as harmless is being labeled a PUP.

Edit: There's also a mention that back in 2009 IObit was accused of plagiarizing certain files native to mbam. Only what I read.

http://www.herdprotect.com/updatepackasc.exe-1ead56ae43328fbc032da2b6c2ba1f806361cbe0.aspx

https://forums.malwarebytes.org/index.php?/topic/151022-updatepackascexe/

Fifth comment down.

Reply #22 Top

For the record, I have several IOBIT programs installed, and the file ( updatepackasc.exe ) is not on my computer. I did a thorough search.

 

So either the file only comes with the free versions, or it is placed there by some kind of malware, but not by IOBIT. 

 

My brother had some malware in his Google directory, but it wasn't google that put it there. Just saying.

Reply #23 Top

Found it on mine. C:/Users/appdata/roaming/temp

Reply #24 Top

Ross, C:/Users/appdata/roaming/temp doesn't even exist on my rig.

Reply #25 Top

Quoting RedneckDude, reply 22

For the record, I have several IOBIT programs installed, and the file ( updatepackasc.exe ) is not on my computer. I did a thorough search.

So either the file only comes with the free versions, or it is placed there by some kind of malware, but not by IOBIT. 
End of RedneckDude's quote

 

You can stick with your records than persistently assured/affirmed that wasn't come from IOBIT whatsoever. 

 

 

Philly0381,don't be. An opinion is just an opinion. I am not have hard-feeling or going to report/complain to whom.