HitmanPro.ALERT Support and Discussion Thread

Discussion in 'other anti-malware software' started by erikloman, May 25, 2012.

Page 418 of 679
  1. guest

    guest Guest

    Yes, i noticed it too after upgrading to HMPA 3.5. The previous version (3.1) was fine with that.

    But MPC-HC is not a good candidate for mitigation, mentioned some time ago:
    #4593
     
    guest, Jul 23, 2016
    #10426
  2. 3x0gR13N

    3x0gR13N Registered Member

    Joined:
    May 1, 2008
    Posts:
    850
    MPC is not listed under mitigations. Process hollow protection is to blame.
     
    3x0gR13N, Jul 23, 2016
    #10427
  3. Armadax

    Armadax Registered Member

    Joined:
    Sep 13, 2015
    Posts:
    19
    Location:
    Zuid-Holland
    Updated from beta to build 546: no problems. (Win 10, x64, Kaspersky Internet Security)
     
    Armadax, Jul 23, 2016
    #10428
  4. XhenEd

    XhenEd Registered Member

    Joined:
    Mar 31, 2014
    Posts:
    536
    Location:
    Philippines
    MPC-HC is fine on my laptop with latest HMP.A (3.5). I could view movies with it.
     
    XhenEd, Jul 23, 2016
    #10429
  5. Stupendous Man

    Stupendous Man Registered Member

    Joined:
    Aug 1, 2010
    Posts:
    2,861
    Location:
    the Netherlands
    Confirmed with HMP.A 3.5.0.546 and MPC-HC 1.7.10, mpc-hc64.exe, portable, on Windows 7 x64 (more details, see signature).
    With HMP.A 3.5.0.546, MPC-HC 1.7.10 crashes on opening video or audio files.
    MPC-HC is not listed under mitigations.
    Adding MPC-HC 1.7.10, mpc-hc64.exe, as an exclusion in HMP.A 3.5.0.546 prevents MPC-HC from crashing with opening a video or audio file.
     
    Stupendous Man, Jul 23, 2016
    #10430
  6. Gapliin

    Gapliin Registered Member

    Joined:
    Feb 12, 2012
    Posts:
    81
    Happens here too with HMPA 3.5.0 build 546 on Win 8.1 (x64).

    MPC-HC 1.7.10.252 crashes during startup:
    Code:
    Name der fehlerhaften Anwendung: mpc-hc64.exe, Version: 1.7.10.252, Zeitstempel: 0x57800c12
Name des fehlerhaften Moduls: mpc-hc64.exe, Version: 1.7.10.252, Zeitstempel: 0x57800c12
Ausnahmecode: 0xc000041d
Fehleroffset: 0x00000000006351d8
ID des fehlerhaften Prozesses: 0x1b50
Startzeit der fehlerhaften Anwendung: 0x01d1e4d721c64890
Pfad der fehlerhaften Anwendung: C:\Program Files (x86)\K-Lite Codec Pack\MPC-HC64\mpc-hc64.exe
Pfad des fehlerhaften Moduls: C:\Program Files (x86)\K-Lite Codec Pack\MPC-HC64\mpc-hc64.exe
    The only workaround is excluding it from HMPA or disabling Process Protection. I tried disabling single mitigations via the import/export feature but eventually it's just the following:

    MPA-HC only works if
    Code:
    <HollowProcessGuard>off</HollowProcessGuard>
    is set or if the profile for MPA-HC is set to
    Code:
    <Template>Exclude</Template>
     
    Gapliin, Jul 23, 2016
    #10431
  7. daman1

    daman1 Registered Member

    Joined:
    Mar 27, 2009
    Posts:
    1,286
    Location:
    USA, MICHIGAN
    Getting a FP? when trying to enter a page on my weather underground site, 373 did not do this;

    Log Name: Application
    Source: HitmanPro.Alert
    Date: 7/23/2016 8:58:15 AM
    Event ID: 911
    Task Category: Mitigation
    Level: Error
    Keywords: Classic
    User: N/A
    Computer: Owner-PC
    Description:
    Mitigation HeapSpray

    Platform 6.1.7601/x64 06_2a
    PID 4288
    Application C:\Program Files (x86)\Internet Explorer\iexplore.exe
    Description Internet Explorer 11

    #00 186F0000 L00020000; Javascript array
    24 F9 8F 6A E0 FD 8D 10 ..00(*9).. A0 0A 5B 7D 61 75 42 ..00(*80).. D0 8E AC 10 00 00 00
    #01 186D0000 L00020000; Javascript array
    24 F9 8F 6A E0 FD 8D 10 ..00(*9).. A0 0A 5B 7D 61 75 42 ..00(*80).. D0 8E AC 10 00 00 00
    #02 186B0000 L00020000; Javascript array
    24 F9 8F 6A E0 FD 8D 10 ..00(*9).. 90 0A 5B 7D 61 75 42 ..00(*80).. D0 8E AC 10 00 00 00
    #03 18690000 L00020000; Javascript array
    24 F9 8F 6A E0 FD 8D 10 ..00(*9).. 90 0A 5B 7D 61 75 42 ..00(*80).. D0 8E AC 10 00 00 00
    #05 18670000 L00020000; Javascript array
    24 F9 8F 6A E0 FD 8D 10 ..00(*9).. 80 0A 5B 7D 61 75 42 ..00(*80).. D0 8E AC 10 00 00 00
    #06 18650000 L00020000; Javascript array
    24 F9 8F 6A E0 FD 8D 10 ..00(*9).. 70 0A 5B 7D 61 75 42 ..00(*80).. D0 8E AC 10 00 00 00
    #07 18630000 L00020000; Javascript array
    24 F9 8F 6A E0 FD 8D 10 ..00(*9).. 70 0A 5B 7D 61 75 42 ..00(*80).. D0 8E AC 10 00 00 00

    Process Trace
    1 C:\Program Files (x86)\Internet Explorer\iexplore.exe [4288]
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4292 CREDAT:1054200 /prefetch:2
    2 C:\Program Files\Internet Explorer\iexplore.exe [4292]
    3 C:\Program Files (x86)\Internet Explorer\iexplore.exe [2004]
    4 C:\Windows\explorer.exe [2284]
    5 C:\Windows\System32\userinit.exe [2204]

    Event Xml:
    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
    <System>
    <Provider Name="HitmanPro.Alert" />
    <EventID Qualifiers="0">911</EventID>
    <Level>2</Level>
    <Task>9</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2016-07-23T12:58:15.000000000Z" />
    <EventRecordID>85569</EventRecordID>
    <Channel>Application</Channel>
    <Computer>Owner-PC</Computer>
    <Security />
    </System>
    <EventData>
    <Data>C:\Program Files (x86)\Internet Explorer\iexplore.exe</Data>
    <Data>HeapSpray</Data>
    <Data>Mitigation HeapSpray

    Platform 6.1.7601/x64 06_2a
    PID 4288
    Application C:\Program Files (x86)\Internet Explorer\iexplore.exe
    Description Internet Explorer 11

    #00 186F0000 L00020000; Javascript array
    24 F9 8F 6A E0 FD 8D 10 ..00(*9).. A0 0A 5B 7D 61 75 42 ..00(*80).. D0 8E AC 10 00 00 00
    #01 186D0000 L00020000; Javascript array
    24 F9 8F 6A E0 FD 8D 10 ..00(*9).. A0 0A 5B 7D 61 75 42 ..00(*80).. D0 8E AC 10 00 00 00
    #02 186B0000 L00020000; Javascript array
    24 F9 8F 6A E0 FD 8D 10 ..00(*9).. 90 0A 5B 7D 61 75 42 ..00(*80).. D0 8E AC 10 00 00 00
    #03 18690000 L00020000; Javascript array
    24 F9 8F 6A E0 FD 8D 10 ..00(*9).. 90 0A 5B 7D 61 75 42 ..00(*80).. D0 8E AC 10 00 00 00
    #05 18670000 L00020000; Javascript array
    24 F9 8F 6A E0 FD 8D 10 ..00(*9).. 80 0A 5B 7D 61 75 42 ..00(*80).. D0 8E AC 10 00 00 00
    #06 18650000 L00020000; Javascript array
    24 F9 8F 6A E0 FD 8D 10 ..00(*9).. 70 0A 5B 7D 61 75 42 ..00(*80).. D0 8E AC 10 00 00 00
    #07 18630000 L00020000; Javascript array
    24 F9 8F 6A E0 FD 8D 10 ..00(*9).. 70 0A 5B 7D 61 75 42 ..00(*80).. D0 8E AC 10 00 00 00

    Process Trace
    1 C:\Program Files (x86)\Internet Explorer\iexplore.exe [4288]
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4292 CREDAT:1054200 /prefetch:2
    2 C:\Program Files\Internet Explorer\iexplore.exe [4292]
    3 C:\Program Files (x86)\Internet Explorer\iexplore.exe [2004]
    4 C:\Windows\explorer.exe [2284]
    5 C:\Windows\System32\userinit.exe [2204]
    </Data>
    </EventData>
    </Event>


    Log Name: Application
    Source: HitmanPro.Alert
    Date: 7/23/2016 8:56:52 AM
    Event ID: 911
    Task Category: Mitigation
    Level: Error
    Keywords: Classic
    User: N/A
    Computer: Owner-PC
    Description:
    Mitigation HeapSpray

    Platform 6.1.7601/x64 06_2a
    PID 5288
    Application C:\Program Files (x86)\Internet Explorer\iexplore.exe
    Description Internet Explorer 11

    #00 188E0000 L00020000; Javascript array
    24 F9 84 6A 80 4B 08 05 ..00(*9).. 70 A1 46 7D 61 75 42 ..00(*80).. F0 56 77 03 00 00 00
    #01 188C0000 L00020000; Javascript array
    24 F9 84 6A 80 4B 08 05 ..00(*9).. 60 A1 46 7D 61 75 42 ..00(*80).. F0 56 77 03 00 00 00
    #02 188A0000 L00020000; Javascript array
    24 F9 84 6A 80 4B 08 05 ..00(*9).. 60 A1 46 7D 61 75 42 ..00(*80).. F0 56 77 03 00 00 00
    #04 18880000 L00020000; Javascript array
    24 F9 84 6A 80 4B 08 05 ..00(*9).. 50 A1 46 7D 61 75 42 ..00(*80).. F0 56 77 03 00 00 00
    #05 18860000 L00020000; Javascript array
    24 F9 84 6A 80 4B 08 05 ..00(*9).. 40 A1 46 7D 61 75 42 ..00(*80).. F0 56 77 03 00 00 00
    #06 18840000 L00020000; Javascript array
    24 F9 84 6A 80 4B 08 05 ..00(*9).. 30 A1 46 7D 61 75 42 ..00(*80).. F0 56 77 03 00 00 00
    #07 18820000 L00020000; Javascript array
    24 F9 84 6A 80 4B 08 05 ..00(*9).. 20 A1 46 7D 61 75 42 ..00(*80).. F0 56 77 03 00 00 00

    Process Trace
    1 C:\Program Files (x86)\Internet Explorer\iexplore.exe [5288]
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4292 CREDAT:3937624 /prefetch:2
    2 C:\Program Files\Internet Explorer\iexplore.exe [4292]
    3 C:\Program Files (x86)\Internet Explorer\iexplore.exe [2004]
    4 C:\Windows\explorer.exe [2284]
    5 C:\Windows\System32\userinit.exe [2204]

    Event Xml:
    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
    <System>
    <Provider Name="HitmanPro.Alert" />
    <EventID Qualifiers="0">911</EventID>
    <Level>2</Level>
    <Task>9</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2016-07-23T12:56:52.000000000Z" />
    <EventRecordID>85567</EventRecordID>
    <Channel>Application</Channel>
    <Computer>Owner-PC</Computer>
    <Security />
    </System>
    <EventData>
    <Data>C:\Program Files (x86)\Internet Explorer\iexplore.exe</Data>
    <Data>HeapSpray</Data>
    <Data>Mitigation HeapSpray

    Platform 6.1.7601/x64 06_2a
    PID 5288
    Application C:\Program Files (x86)\Internet Explorer\iexplore.exe
    Description Internet Explorer 11

    #00 188E0000 L00020000; Javascript array
    24 F9 84 6A 80 4B 08 05 ..00(*9).. 70 A1 46 7D 61 75 42 ..00(*80).. F0 56 77 03 00 00 00
    #01 188C0000 L00020000; Javascript array
    24 F9 84 6A 80 4B 08 05 ..00(*9).. 60 A1 46 7D 61 75 42 ..00(*80).. F0 56 77 03 00 00 00
    #02 188A0000 L00020000; Javascript array
    24 F9 84 6A 80 4B 08 05 ..00(*9).. 60 A1 46 7D 61 75 42 ..00(*80).. F0 56 77 03 00 00 00
    #04 18880000 L00020000; Javascript array
    24 F9 84 6A 80 4B 08 05 ..00(*9).. 50 A1 46 7D 61 75 42 ..00(*80).. F0 56 77 03 00 00 00
    #05 18860000 L00020000; Javascript array
    24 F9 84 6A 80 4B 08 05 ..00(*9).. 40 A1 46 7D 61 75 42 ..00(*80).. F0 56 77 03 00 00 00
    #06 18840000 L00020000; Javascript array
    24 F9 84 6A 80 4B 08 05 ..00(*9).. 30 A1 46 7D 61 75 42 ..00(*80).. F0 56 77 03 00 00 00
    #07 18820000 L00020000; Javascript array
    24 F9 84 6A 80 4B 08 05 ..00(*9).. 20 A1 46 7D 61 75 42 ..00(*80).. F0 56 77 03 00 00 00

    Process Trace
    1 C:\Program Files (x86)\Internet Explorer\iexplore.exe [5288]
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4292 CREDAT:3937624 /prefetch:2
    2 C:\Program Files\Internet Explorer\iexplore.exe [4292]
    3 C:\Program Files (x86)\Internet Explorer\iexplore.exe [2004]
    4 C:\Windows\explorer.exe [2284]
    5 C:\Windows\System32\userinit.exe [2204]
    </Data>
    </EventData>
    </Event>
     
    daman1, Jul 23, 2016
    #10432
  8. plat1098

    plat1098 Guest

    Firefox still crashes with latest HMP-A :rolleyes:. I don't want to disable DEP mitigations, so is there an alternative adjustment for the meantime? Not really a big problem, just irritating.

    Firefox 47.01/HitmanPro Alert 3.5.0 build 546

    edited to add: Could one go back to the beta or is support for that being discontinued?
     

    Attached Files:

    Last edited by a moderator: Jul 23, 2016
    plat1098, Jul 23, 2016
    #10433
  9. L10090

    L10090 Registered Member

    Joined:
    Feb 13, 2015
    Posts:
    302
    Location:
    Netherlands
    Confirmed for W7-x64 with HMP.alert 3.5 build 546!
    Using HMP.alert 3.1 build 474, only unchecking "Null Page" mitigation is enough to run MPC-HC 1.7.10 as a protected application.
     
    L10090, Jul 23, 2016
    #10434
  10. erikloman

    erikloman Developer

    Joined:
    Jun 4, 2009
    Posts:
    3,152
    Location:
    Hengelo, The Netherlands
    Try adding it to the Exclude category via the blue tile.

    The fact that Process Protection triggers should say something about how MPC was built. Why is it using so many weird techniques to play video's?
     
    erikloman, Jul 23, 2016
    #10435
  11. Rasheed187

    Rasheed187 Registered Member

    Joined:
    Jul 10, 2004
    Posts:
    17,559
    Location:
    The Netherlands
    Rasheed187, Jul 23, 2016
    #10436
  12. L10090

    L10090 Registered Member

    Joined:
    Feb 13, 2015
    Posts:
    302
    Location:
    Netherlands
    Adding MPC to the Exclude category (via the blue tile) allows MPC to run video's etc....
    I personally have no issue/problem with running MPC 'Excluded' in 3.5 build 546 and following releases.
     
    L10090, Jul 23, 2016
    #10437
  13. Fad

    Fad Registered Member

    Joined:
    Feb 25, 2009
    Posts:
    456
    Location:
    England
    I have always needed to exclude MPC-HC (& MPC-BE) from Alert`s protection, I don`t use any online features so I`m not overly concerned.

    3.5. 546 - all appears OK here.
     
    Fad, Jul 23, 2016
    #10438
  14. Stupendous Man

    Stupendous Man Registered Member

    Joined:
    Aug 1, 2010
    Posts:
    2,861
    Location:
    the Netherlands
    I don't know. One reason may be to be able to play 'difficult' media.
    For instance, I use VLC media player as my primary media player, but for a 'difficult' dvd, like the Wall-E dvd, I need to use MPC-HC to play that dvd correctly. I tried several other media players, but MPC-HC was the only one that would play the Wall-E dvd without issues. Perhaps this is because of some helpful but 'weird' techniques that MPC-HC uses? I'm just guessing.

    Me neither. But it might be an issue for less tech savvy users. MPC-HC is rather popular. If many HMP.A users would complain about HMP.A crashing MPC-HC, that might put a burden on SurfRight support.
     
    Stupendous Man, Jul 23, 2016
    #10439
  15. Houley456

    Houley456 Registered Member

    Joined:
    Feb 9, 2007
    Posts:
    199
    What is MPC-HC
     
    Houley456, Jul 23, 2016
    #10440
  16. Rasheed187

    Rasheed187 Registered Member

    Joined:
    Jul 10, 2004
    Posts:
    17,559
    Location:
    The Netherlands
    Rasheed187, Jul 23, 2016
    #10441
  17. XIII

    XIII Registered Member

    Joined:
    Jan 12, 2009
    Posts:
    1,383
    Had two occurrences where Firefox could not keep up with my typing speed.

    After I stopped typing (in the search field) several characters appeared, but random gibberish.

    HMP.Alert keylogger protection?
     
    XIII, Jul 23, 2016
    #10442
  18. daman1

    daman1 Registered Member

    Joined:
    Mar 27, 2009
    Posts:
    1,286
    Location:
    USA, MICHIGAN
    daman1, Jul 24, 2016
    #10443
  19. bjm_

    bjm_ Registered Member

    Joined:
    May 22, 2009
    Posts:
    4,458
    Location:
    .
    @anyone > Is 2) this just me. Is Block Untrusted Fonts in anyway looking at Yahoo buttons.
    @erikloman > Does 3.5 Build 546 return Safe browsing (green) for Norton users...?
     
    Last edited: Jul 24, 2016
    bjm_, Jul 24, 2016
    #10444
  20. test

    test Registered Member

    Joined:
    Feb 15, 2010
    Posts:
    499
    Location:
    italy
    Hi, bjm:
    how long before you trash that AV??

    Norton = garbage, rubbish,...


    If i was you, i'll replace it ASAP with any free AV, for eg Avira :isay:...
     
    Last edited: Jul 24, 2016
    test, Jul 24, 2016
    #10445
  21. test

    test Registered Member

    Joined:
    Feb 15, 2010
    Posts:
    499
    Location:
    italy
    Alert = truly a jewel (especially as AntiExploit solution on Intel CPU txs to its Hardware-assisted CFI) so, if something else interfers with it (in particular, NorTrash), i'll have no doubt about who remove...

    IMO :)
     
    test, Jul 24, 2016
    #10446
  22. bjm_

    bjm_ Registered Member

    Joined:
    May 22, 2009
    Posts:
    4,458
    Location:
    .
    Is Block Untrusted Fonts in anyway looking at Yahoo buttons.
     
    bjm_, Jul 24, 2016
    #10447
  23. test

    test Registered Member

    Joined:
    Feb 15, 2010
    Posts:
    499
    Location:
    italy
    uh?
     
    test, Jul 24, 2016
    #10448
  24. bjm_

    bjm_ Registered Member

    Joined:
    May 22, 2009
    Posts:
    4,458
    Location:
    .
    #10453
     
    bjm_, Jul 24, 2016
    #10449
  25. test

    test Registered Member

    Joined:
    Feb 15, 2010
    Posts:
    499
    Location:
    italy
    Last edited: Jul 24, 2016
    test, Jul 24, 2016
    #10450
Page 418 of 679
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...