HitmanPro.ALERT Support and Discussion Thread

Plex Home Theather crashes when closing, even though it is not added to Protected applications.

Code:

Probleemhandtekening:
  Gebeurtenisnaam van probleem:    APPCRASH
  Naam van de toepassing:    Plex Home Theater.exe
  Versie van toepassing:    1.3.5.431
  Tijdstempel van toepassing:    54992b9e
  Naam van foutmodule:    hmpalert.dll
  Versie van foutmodule:    3.0.22.131
  Tijdstempel van foutmodule:    5496bf8b
  Uitzonderingscode:    c0000005
  Uitzonderingsmarge:    0000bbfe
  Versie van besturingssysteem:    6.1.7601.2.1.0.256.1
  Landinstelling-id:    1043
  Aanvullende informatie 1:    dae0
  Aanvullende informatie 2:    dae0841d28bb3a301a419e5efe5b0022
  Aanvullende informatie 3:    84bd
  Aanvullende informatie 4:    84bd7dfdecfe66867f21d5e93644556e

Win7 32 bit with Avast Free 2015 build 2208 and EMET 5.1

 

I am unsure why this crash happens. For the moment disable the DEP mitigation on Plex.

 

I have done that and it is still the same.(I disabled it on Plex in EMET if that is what you meant, Plex isn't protected by Alert and I didn't add it myself yet.)

 

Interesting. I will try to reproduce.

 

Probably a silly question, but What is the process of actually buying a license for HMPA? When I click on the purchase it will take me to the Hitman Pro purchase page, but I wasn't sure if that includes the Alert as well?

 

Dear Erik and Mark Loman,
and also other posters/readers,

I have been following most of the posts regarding HMP.A v3 (and also the EMET thread and the EMET, MBAE and HMP.A thread).
I haven't tried the HMP.A v3 CTP and RC versions myself.

For now I use HMP.A v2.6.5.77 for its CryptoGuard feature,
and I use EMET 5.1 with Windows Vista x86, which combination works OK for me,
and I use EMET 4.1 Update 1 with Windows 7 x64, as I find that EMET 5.1's browser slow down with Windows 7 x64 makes it practically unusable, even with EAF+ disabled.
In a while, my Vista x86 machine will have a clean install as a Windows 7 x64 machine, so I probably will need to use that with EMET 4.1u1 instead of EMET 5.1, as well.

I have hopes for using HMP.A 3 (final) as an alternative to EMET.
However, my computers have no Intel Core i3, i5 or i7 processors, but Core 2 Duo processors, so HMP.A 3 hardware-assisted exploit protection won't be available for those computers.

Now my question is,
could you tell me, please,
with no i3, i5 or i7 processor, so without HMP.A 3 hardware-assisted exploit protection, how strong is HMP.A 3 exploit protection, compared to EMET 4.1 Update 1 and compared to EMET 5.1?
Is HMP.A 3 exploit protection still better, even without the hardware-assisted exploit protection, or is it about the same as EMET 4.1u1 and EMET 5.1 exploit protection?

Thank you very much.

 

I believe it's the same license for both which is perhaps why there isn't a separate purchase option for Alert.

 

Yes, it is the same license, for both HMP and HMP.A.
As Erik and Mark usually say, buy one and get the other one for free.

 

I think that's one of the biggest advantages of HMP. Technology that offers a good second layer of defense for a very affordable price.

 

I've had Firefox not open after clicking the Task Bar icon once again, Task Manager showed FF was running. No MBAE installed.

Thank you.

 

The exploit protection that HitmanPro.Alert 3 offers is more extensive than EMET 5.1. Especially because of Alert's Application Lockdown and Import Address Table Filtering (part of our Control-Flow Integrity) mitigations. Also Alert offers a install-and-forget approach, so if you install a new media player or browser, you do not need to configure Alert to protect the new applications.
Don't get me wrong, Microsoft EMET is an outstanding tool built for power users and does what it's built for. But its usefulness ends when an exploit attack is not about memory corruption. If the attack abuses a logic-flaw vulnerability (such as CVE-2014-4114; OLE), a VBA macro in an Office document, or e.g. revolves around Java, remote code execution (RCE) succeeds and the malicious payload will be delivered (the machine becomes infected and it's up to the antivirus software to catch it). Especially VBA macros are back and are highly prolific in today's spam emails.

BTW, be sure to upgrade to HitmanPro.Alert 3 as CryptoGuard's detection logic is greatly improved over CryptoGuard in HitmanPro.Alert version 2.

 

Thank you very much, Mark.
So all of that is not dependent on HMP.A 3's hardware-assisted exploit protection? That's good to know.
I read so much about why HMP.A 3's hardware-assisted exploit protection is so great, that I really wondered what protection remains without the hardware-assisted protection.
As there are still quite some users that don't have i3, i5 or i7 processors, I think it is good to get some clarity about what that means for HMP.A 3's capabilities.

I will, and I know, but I didn't want the hassle of testing the CTP and RC versions.
But I will use the HMP.A 3 final, I'm looking forward to it.
Thanks again.

 

I refer to recent problems that I mentioned.

This morning I went back into the snapshot, and nearly 8 hrs or so later, no problem.

Spoiler: screenshot

 

It just crashed...

Spoiler: screenshots

 

Can you run ProcDump to get a crash dump when this happens? Do you know how to use this tool?

 

I know it is a sysinternals tool. Other than that, I know nothing else about it. I did find this link, but looks like it is over my head as to what I should do. - http://blogs.technet.com/b/kristinw...her-dump-dmp-files-for-crashes-and-hangs.aspx

 

@ Tarnak

You do realize that you're running at least 8 other security tools? Perhaps you can make a list of them. But what I'm trying to say is: the more tools you're using, the greater the chance of conflicts.

 

Getting ready to buy, but quick question; I will probably be building my new rig in the next few months, will the license be able to transfer from this computer to the new one, as long as it is the only one in use of course.

 

Yes,you should be able to transfer the license by contacting SurfRight support

 

Excellent! I'm good until September 25, 2017. Thank you Erik and Mark.

 

Hi Erik, did you see the crash dump I sent on dec 24?

 

I have just opened them. The dumps say that the modules are overlapping each other. This hinders analysis of the dumps

 

Quick question here if I may? Now I know I may have missed a previous discussion on this but HP.A v2.6.5 is currently freeware...yes? So will v3 be too when publically released or will the purchase of a license be required for its use going forward. As I said, apologies if I have missed the prior discussion on this point.

Many thanks, Baldrick

 

All features in v2 are in v3 and remain free. In addition there are other free features like Keystroke Encryption, Webcam Notifier, BadUSB protection and a much improved CryptoGuard to block the newer crypto-ransomware families.

Only the Exploit Mitigation feature and Active Vaccination require a license. You can use the same HitmanPro license for Alert. Alert will pick up the license automatically if you already activated HitmanPro. So if you already purchased a license, you get Alert 3 for free.

Hope this helps.

 

Hi erikloman

Many thanks for the response...it is much appreciated and clarifies much. If I may just ask further; I have switch on the Active Vaccination functionality...to test it...but can find at present no way to switch it off if I want to. The trial license is now running and will expire in x days. Whilst I am very interested in this feature, and the Exploit Mitigation functionality, is there a way to switch this/these feature/s off should I decide that I do not want them or will v3 just revert to providing the free functionality at the end of the trial period?

Many thanks for your patience in this matter...I have not yet made up my mind as to how I will go but thought it best to ask now, just in case...

Cheers, Baldrick