Hitman Pro Support and Discussion Thread

Oh no, please no Bloatman Pro

It also scans with Spyware Blaster 3.5.1 (freeware)? Is there any way to scan with Spyware Blaster?

[Saraceno]

ance, I'm not understanding your comment.

The old version 2 was a collection of downloads, including spyware blaster.

New version (3 and 3.5), uses the same name, but is a completely new product. See Mark Loman's post.

Originally Posted by markloman

The mentioned link points to a page at Surfing Safe. The information there is outdated, somewhat inaccurate and about a very old version Hitman Pro, that has nothing to do with Hitman Pro 3 let alone 3.5. The new software only carries the name since it is very popular in Holland and still has some of the philosophy: best virus identification using multiple trusted security vendors (currently seven in the Scan Cloud).

The Hitman Pro 3.5 client software is using in-house developed technology only. The engine is a new innovation and capable of quickly distinguishing legitimate and malicious files without using traditional virus signatures. The engine is called the Behavioral Scan and is best described as association mining. It generates a threat score. The Behavioral Scan threat score makes it possible to detect zero-day malware and warrant a consult with the Scan Cloud. Hitman Pro 3.5:

• Analyses memory objects (processes, handles and modules)
• Detects invisible files by comparing raw data and information received from common Windows API’s
• Locates files that start automatically or are linked to
• Analyses PE files and determines and analyses:

• Data entropy (an indication if a file is compressed or encrypted to hinder virus analysts)
• PE import tables and data directories
• Anomalies commonly found in malware

• Determines file properties like file age, version, publisher, Authenticode signatures
• Determines whether or not a file came from the internet
• Determine the reputation of the website / link a file came from
• Tries to determine if a file belongs to as uninstallable registered software
• If a program interacts or is visible for the user
• If a file has the same name as a common Windows process or has an uncommon extension
• Uses an innovative technique called Gossip Rating to catch zero-day fake anti-malware (rogues) - security related websites and forums often debate new rogues sooner than security professionals

This is just some of the information the Behavioral Scan collects and correlates to dynamically determine a threat score for each file. For experienced users Hitman Pro 3.5 contains a new system called Early Warning Scoring (EWS) to help them catch zero-day malware. EWS is possible thanks to the technology behind the Behavioral Scan.

Hitman Pro 3.5 has also an in-house developed removal engine named Crusader. New is ex. the capability to physically disabling a malicious file. It can also restore registry keys to safe defaults and also restores infected critical system files by safe original versions (it looks for them on the disk and offers the user to use an original Windows installation disk).
To handle resilient malware, the engine is equipped with a boot-time removal service in addition to a native NT bootdeleter, to thoroughly remove malicious files and its references (registry objects and shortcuts).

Just like version 3.0, Hitman Pro 3.5 is actually a brand new program. Version 3.5 is redeveloped from scratch in C++ (3.0 kept being false positived by antivirus software because ex. NOD32 blacklisted a complete programming language).
Keep an eye on the site for detailed information: http://www.surfright.nl/en/hitmanpro . To celebrate the release Hitman Pro 3.5 will receive a new icon as well – official release will be in the coming week.

[Kees1958]

Hi,

In Holland, Hitman Pro helped a lot of people when spyware hit the web. Some of the old programs did very well at that time. As Mark said, from branding perspective it make sense to keep the name, even when the product is completely changed. It is easier in their home markket to build on the brand value created with previous version (should say products).

IMO Hitman Pro is a better application than former CSI Free, because it uses simular mechanismes with more avanced reference and still has the old lisence structire of PrevX1. When you are hit, you can use the trial period and can be helped right away.


Regards

Originally Posted by Saraceno

The old version 2 was a collection of downloads, including spyware blaster.

New version (3 and 3.5), uses the same name, but is a completely new product. See Mark Loman's post.

Originally Posted by Kees1958

As Mark said, from branding perspective it make sense to keep the name, even when the product is completely changed.

I see, thank you

[Saraceno]

Seems to have updated recently, now RC3. There will be some new features coming.

Tried Hitman Pro on a few more 'known malware' files tonight, all were detected as trojans.

[raven211]

Originally Posted by Saraceno

Seems to have updated recently, now RC3. There will be some new features coming.

Tried Hitman Pro on a few more 'known malware' files tonight, all were detected as trojans.

What new features are we talking about?

[rdsu]

It collect some user data?

Now what really would make be happy would be a portable version or preferably a live cd.

[LagerX]

I got computer with malware infection. It was soo slow and CPU usage was really high, no matter what I did. (even on browsing, IE6 took 80+% CPU)

So I though it will be infected. First thing, I tryed to find out what Prevx says.
I downloaded it and tryed to install. No success. I got error, that had only one option - close.
I tryed to rename it to random name. No success. Safe mode installation - no success.

After I knew something is blocking it, I went to download MBAM. It was installed successfully. After update I made quick scan. But when it went to scan system32 folder, then computer restarted after some time.
After some tryes, I installed Avast! do to boot time scan. Computer restarted after Avast! had scanned some files in system32 folder.

SAS didn't help either. On installation, all went fine. But updating=99% CPU. I waited 5 minutes, no luck. It wouldn't finish updating.

I was out of ideas. Then I tryed Hitman Pro. It scanned system nicely and found one rootkit and trojan. Executable names were PEV.exe and nircmd.exe.
I don't remember which on was rootkit, which trojan, but it successfully removed both of them. After restart, computer was back to normal. I was able to install Prevx 3.0 and it didn't find anything after that.

So, 5+ Hitman Pro.

Unfortunately I don't got those files anymore. Otherwise I would send them to Prevx for investigation. I think Hitman Pro was successful because it isn't really targeted by malware. But anyway, I really look that Hitman Pro has potential and is nice tool

[raven211]

Originally Posted by LagerX

I got computer with malware infection. It was soo slow and CPU usage was really high, no matter what I did. (even on browsing, IE6 took 80+% CPU)

So I though it will be infected. First thing, I tryed to find out what Prevx says.
I downloaded it and tryed to install. No success. I got error, that had only one option - close.
I tryed to rename it to random name. No success. Safe mode installation - no success.

After I knew something is blocking it, I went to download MBAM. It was installed successfully. After update I made quick scan. But when it went to scan system32 folder, then computer restarted after some time.
After some tryes, I installed Avast! do to boot time scan. Computer restarted after Avast! had scanned some files in system32 folder.

SAS didn't help either. On installation, all went fine. But updating=99% CPU. I waited 5 minutes, no luck. It wouldn't finish updating.

I was out of ideas. Then I tryed Hitman Pro. It scanned system nicely and found one rootkit and trojan. Executable names were PEV.exe and nircmd.exe.
I don't remember which on was rootkit, which trojan, but it successfully removed both of them. After restart, computer was back to normal. I was able to install Prevx 3.0 and it didn't find anything after that.

So, 5+ Hitman Pro.

Unfortunately I don't got those files anymore. Otherwise I would send them to Prevx for investigation. I think Hitman Pro was successful because it isn't really targeted by malware. But anyway, I really look that Hitman Pro has potential and is nice tool

Maybe Joe can clarify if they get some data through Hitman as well.

[StevieO]

Yeah after reading through this thread i thought i'd give it a shot. I knew about the earlier versions from a few years back, but never used them.

I'm using a reasonably fast broadband connection.

Anyway, after many " failed to upload " notices on lots of files etc, i gave up and cancelled the scan.

Up until then it had detected quite a few real Malware samples in a folder, along with a few FP's elsewhere.

The concept is nice, but in actuality, the App needs a bit more tinkering. I can envisage it potentially turning into a useful bit of kit though.

So well done for the integration etc that's been accomplished, and all the best for the future.

[Saraceno]

StevieO, I reported this to Mark who develops the program and he was looking into the issue. I suggested having a 'retry upload' when files are being analysed.

He mentioned a 'right-click' and scan option is in the works which would allow users to select single files, and have these analysed by several scanners.

Any problems, just report them to their email. It's still not a final release.

[Saraceno]

Gave it a few more scans with the latest version, and haven't had any errors with the uploads. Hopefully it's fixed.

[andyman35]

There's a new build out today (59) so presumably there should be some bugfixes.

[Eagle Creek]

For those who can read Dutch (or know where to find Google Translate):http://www.surfright.nl/nl/whatsnew.

[erikloman]

Originally Posted by Eagle Creek

For those who can read Dutch (or know where to find Google Translate):http://www.surfright.nl/nl/whatsnew.

The entire website is both English and Dutch (use the dropdown list on the top-left of the website to change the language).
The direct URL to the list of features: http://www.surfright.nl/en/whatsnew

Also, there is a product description (23 pages, PDF document) which has a lot more background information. This document is currently only available in Dutch though and can be downloaded here: http://files.surfright.nl/productbes...man-pro-35.pdf

[andyman35]

"Release History
Build 59 (2009-06-04)

Finetuned timeouts concerning Scan Cloud (fixes "Upload failed").
Added Estonian language texts to the user interface. Thanks to Lauri SC."

[Saraceno]

Seeing the Microsoft Security Essentials review, noticed Hitman Pro 3.5 was recently reviewed by PC Mag.

Hitman Pro 3.5
http://www.pcmag.com/article2/0,2817,2348569,00.asp

Overall, a balanced review, explained various aspects about the program, including the 'early warning scoring', where files are ranked on how malicious they are, even when there is no internet connection. For a new program still developing and with more features being implemented shortly, to me it's definitely a good up-and-coming program.

Hi,
I'm kind of confused.
This product is 30-day trial?
Thanks

[TonyW]

I did test this, but couldn't see how to report a FP from the scan result. After a scan of my system, it reported the FD-ISR service - isrservice.exe - as suspicious. No options seemed to be available to right-click on the scan result to submit this file or anything like that. I just chose the option to not delete it.

[andyman35]

Originally Posted by Gaeko

Hi,
I'm kind of confused.
This product is 30-day trial?
Thanks

The product offers unlimited free detection ,the 30-day trial is for removal of any malware found.

[prairie dog]

I scan daily with Hitman pro 3.5 and it always flags a file from my HP printer as a trojan. Ran scans with MBAM, SAS, ESET online scanner, AVG, Bitdefender and a few others and always comes back clean. Even ran it through Virustotal and jotti, all came back 100% clean. Does anyone know how to get in touch with Hitman to remove this false positive? Thanks

[TonyW]

Originally Posted by prairie dog

Does anyone know how to get in touch with Hitman to remove this false positive?

Same request goes for post #120.

[Saraceno]

I'd send an email to the one listed on the contact page:
info@surfright.nl

[prairie dog]

Originally Posted by Saraceno

I'd send an email to the one listed on the contact page:
info@surfright.nl

Thanks for the info. I just sent them an email and will post back once I find out how to proceed