Jump to content


QuickBooks update installing adware?

  • Please log in to reply
2 replies to this topic

#1 PhilQ



  • New Member
  • Pip
  • 2 posts

Posted 21 July 2004 - 08:32 PM

Hi all,

I made an interesting discovery after running the QuickBooks update routine that I thought everyone should know about. I discovered a command to run a batch file in HKLM/Software/Microsoft/RunOnce after performing a QuickBooks update. The batch file is called mktpatch.bat, the contents of which are as follows:

if not exist C:\PROGRA~1\Intuit\QUICKB~1\MktPopAddinW.dllB goto :EOF
if exist C:\PROGRA~1\Intuit\QUICKB~1\MktPopAddinW.dll del C:\PROGRA~1\Intuit\QUICKB~1\MktPopAddinW.dll
ren C:\PROGRA~1\Intuit\QUICKB~1\MktPopAddinW.dllB MktPopAddinW.dll
C:\WINNT\system32\regsvr32 /S C:\PROGRA~1\Intuit\QUICKB~1\MktPopAddinW.dll

My specialty is real-time embedded software development, not Windows programming. I'm uploading the DLL file in case someone is interested in trying to figure out exactly what it does, I'd be interested in hearing about your findings. At first glance, it appears to be something to add marketing popups.

- Phil

Attached Files

#2 Tuxedo Jack

Tuxedo Jack

    Creator of TuxPE, a Cat5-o'-9-Tails, Etherkillers, and more

  • Expert
  • PipPipPipPipPip
  • 1,758 posts

Posted 23 July 2004 - 01:06 AM

From the look of it (raw dump in Notepad), it seems to open up a popup inside Quickbooks advertising something. Don't know what, though.
Signature file is under revision. This will be back shortly.

#3 PhilQ



  • New Member
  • Pip
  • 2 posts

Posted 29 July 2004 - 08:56 PM

I'll bet it's to advertise check printing and other banking type services that they offer their customers.

Thanks for taking a look at it.

- Phil

Member of UNITE
Support SpywareInfo Forum - click the button