Hitman Pro Support and Discussion Thread

Hi, Stupendous Man,

Here is the answer from Support@Hitman Pro!

~Private email removed. See the TOS for this forum~

My answer is as follow below:

"HMP doesn't drop a lot of files, it has two directories, one in Program Files, one in Program Data (hidden). If you delete those, that could be considered as an un-installation."
"Additionally, if you regedit and search for "hitmanpro", you should be able to find and delete plenty."
"I'd rather recommend you use a third-party un-installer like Revo and/or Geek un-installer which might be able to locate it."

Hope this help with further question on Hitman Pro!

Best regards,

Moose

 

Don't know if this question has been asked before.
Why does HitmanPro want outbound connection to remote address download.windowsupdate.com on TCP port 80?

 

HitmanPro 3.7.9 Build 219 Released

Changelog

• ADDED: Detection of user32.dll infected system files
  More info: http://hitmanpro.wordpress.com/2014/06/13/ransomware-infecting-user32-dll/
• IMPROVED: Repair of infected system files
• IMPROVED: MBR rootkit detection
• IMPROVED: Remnant detection
• IMPROVED: Application termination while processing JSON files
• IMPROVED: Portuguese language
• ADDED: Croatian language
• UPDATED: Embedded white lists

Existing users are automatically updated.

Please let me know how this version runs on your system

 

Hi Erik

Any infos about it

 

No problems with build 219 (W7 64 bits). Its faster too (< 4 minutes, build 216 ~ 5 minutes). Nice.

Edit: Did not autoupdate. Had to downlaod new version.

 

No problem here with auto update. Working good.

 

No problems running build 219 and Vista 32 bits. Also no problem with autoupdate from 216 to 219.

 

HitmanPro 3.7.9 Build 219 Released
Got it by auto update.

 

Croatian language.
Very nice

 

Via AutoUpdate HitmanPro 3.7.9 Build 219 runs fine on my win 7 32 bit System

Thx @erikloman

 

@erikloman or anyone else on Wilders.

No answer to my question if you happened to of missed it.

Why does HitmanPro request outbound connection to remote address download.windowsupdate.com on TCP port 80?

 

That's how it checks for an active internet connection.

 

Thanks 3x0gR13N. Since HitmanPro is already checking for internet connection on it's own domain, why use
download.windowsupdate or am I missing something here?

 

Runs fine on my systems, scans quick, no issues, both normal and EWS

 

This way it can figure out if the remote cloud is down instead of the user's internet connection being at fault.

 

Please cite your source.

 

Some recent posts about connectivity and uninstall tweaked my curiosity...

HMP 3.7.9.219 connections; auto upload of suspicious files disabled. Win7hpSP1x64.
Location: South West USA. (Other locations and/or Windows no doubt may trace different routes.)

HitmanPro_x64.exe itself:
ports 80 & 443 to ALIENTRICK, Virtu Secure Webservices, Enschede, The Netherlands
port 80 to TRANSPITT We Are Online, ReasonNet IP Networks, Amsterdam
port 53 UDP to OpenDNS
port 53 UDP to ONLINE-BACKBONE-NETWORKS-DNS, Amsterdam
port 53 UDP to ONLINE-SERVER-LAN, EH Den Haag, The Netherlands
AND... explorer.exe port 80 to AKAMAI

There is no reason why any app should evoke connections via explorer.exe. All protocols in/out are blocked & with Ask in my firewall (should I wish to allow for a session which I've never done). It didn't seem to interfere with HMP's scan in the scenario above.

HitmantPro.exe from Program Files directory:
ports 80 & 443 to ALIENTRICK, Virtu Secure Webservices, Enschede, The Netherlands
same port 53's
explorer.exe not evoked

Revo Unistaller Pro 3.0.8 reported these leftovers:
HKEY_LOCAL_MACHINE\SOFTWARE\HitmanPro containing a multitude of items
C:\ProgramData\HitmanPro & C:\ProgramData\HitmanPro\Logs containing .bin and .log files

This is a report, not a critique. Cheers.

 

Somewhere in this 245+ page thread. Sorry, can't be bothered to search it.
From a logical standpoint it makes sense for them to implement it that way.

 

Of course it is.

 

It's also possible it's retrieving the third-party root list sequence number from: http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt
If you can sniff out the exact URL of the HMP connection you can verify the above.
But, only the developer can confirm for certain.

 

New version working fine here, but even before removing tracking cookies, it wants to create a restore point.

 

Is anyone else getting a potential false positive for user32.dll? HMP is detecting it in two locations: System32 and SysWOW64. The detection is Win64/Trojan.patched and Win32/Trojan.patched.
I'm fairly certain they're not malicous, but I really have no idea:

https://www.virustotal.com/en/file/...e211e0af514f4f4b681522a0/analysis/1403773889/
https://www.virustotal.com/en/file/...913b15c96cac14e4f04075b4/analysis/1403773905/

HMP never successfully removes the file.

 

This FP is caused by an encrypted disk. We've prepared an update which will go online in a few hours.

Meanwhile a beta can be downloaded here:
http://dl.surfright.nl/HitmanProBeta.exe
http://dl.surfright.nl/HitmanProBeta_x64.exe

 

Not with my Windows Vista SP2 x86.

What Windows version do you use?
Vista, Windows 7, Windows 8?

Did you do a default HitmanPro scan,
or was it an Early Warning Scoring (EWS) scan?

EDIT
Never mind.
Erik already replied it was a false positive detection caused by an encrypted disk.

 

Ah that explains it, thanks.