HitmanPro.ALERT Support and Discussion Thread

I was running beta v603 until a few minutes ago and it did not display APC as a separate item; only DLL Hijacking was displayed in v603, the same as v604.

 

Thanks very much, mood.

 

Same here on my system.

 

Refer to this post #13833 where I previously questioned it: HitmanPro.ALERT Support and Discussion Thread

 

Windows 10 Home 64-bit

 

The 7xx have a specific toggle for APC mitigation.
The 6xx build collapses the APC mitigation under process protection. So if you want to disable APC mitigation, turn off Process Protection.

 

txs Erik...and keep up the good work!

Ciao

 

Right, for the past month or so I'm unable to use the scan on HitmanPro.Alert, It keeps saying : Failed (http://imgur.com/a/QGi8c mislukt = failed). Tryed adding it to the exeptions list of my firewall, antivirus... (I use Kaspersky Internet security).

 

This worked for me:

 

Hi @Dxxa

I use Kaspersky IS 17.0.0.611 (e) and no problems here. No exeptions in KIS. Anyway, I have HitmanPro installed.

 

Having HitmanPro installed may be the difference.
That is why Socio quoted my May 29, 2017 suggestion to install HitmanPro.

 

I found an interesting posting while browsing my weekly batch of tech articles. This is a posting from MS talking about an article titled, "Announcing end-to-end security features in Windows 10" (https://blogs.windows.com/business/2017/06/27/announcing-end-end-security-features-windows-10/#7TKuJ68esvs6kCUB.97).

It lists something known as Windows Defender Exploit Guard. This seems to be wrapped in part of the Windows 10 Fall Creators Update. A lot of the features appear to be tied to the Edge browser.

I am wondering how HitMan Pro Alerts will run alongside this? How well will HMPA play with Windows Defender Exploit Guard?

 

I asked similar some days ago: https://www.wilderssecurity.com/thr...iscussion-thread.324841/page-562#post-2686023 but there was no response.

 

Windows Defender Exploit Guard is already available in the latest Insider Build 16232. More here:

https://www.tenforums.com/windows-1...ider-preview-build-16232-pc-15228-mobile.html

Brave souls can test HMPA with it . That said the recommendation is not to run more than one exploit tool. Based on the description in the ten forums thread it sounds like there's an option to turn off exploit protection in Windows Defender.

 

Whoa, this could really cut into SurfRight/Sophos's sales going forward.

It would be interesting to see a side-by-side comparison of the effectiveness of this new Exploit Guard vs. HMP.A.

 

+1

Could this Exploit Guard be the reason that Microsoft ended support for EMET? Thought I read that somewhere.

 

Hi!

There seems to be a compatibility issue between Webroot SecureAnywhere and HitmanPro.Alert.

WSA 9.0.17.24
HitmanPro.Alert 3.6.7 build 604
Windows 10 version 1703 (OS Build 15063.447)

Symptoms:

Mozilla Firefox and Opera browsers crash on startup.

Sometimes re-installation of either browser from a full installation package will help for a while, but eventually (after a reboot or so) the problem comes back. I've seen this behaviour on three different laptops with similar setups (both WSA & HitmanPro.Alert installed).

Shutting down WSA with "Shut down protection" from the systray menu immediately solves the problem.

Also, if you uninstall either product, (WSA or HitmanPro.Alert) the problem goes away.

Please note that I've been running both products alongside each other for the last 1.5 years without problems, so this is a new thing probably introduced with the latest update of either WSA or HitmanPro.Alert. Both got upgraded within the last two weeks, so I cannot exactly point out which one caused the problem.

Has anyone else seen the same thing?

Example Firefox crash entry from the Windows Event Viewer:

Faulting application name: firefox.exe, version: 54.0.1.6388, time stamp: 0x5953d1f8
Faulting module name: winhttp.dll, version: 10.0.15063.0, time stamp: 0xe3bf748c
Exception code: 0xc0000409
Fault offset: 0x00083d77
Faulting process ID: 0x3f48
Faulting application start time: 0x01d2f55c4b81e4c5
Faulting application path: C:\Program Files (x86)\Mozilla Firefox\firefox.exe
Faulting module path: C:\WINDOWS\SYSTEM32\winhttp.dll
Report ID: b1a7836b-b6ba-49d7-be5a-05f9c5e665f6
Faulting package full name:
Faulting package-relative application ID:

 

Dxxa, are you running as a standard user? I have run into a similar issue on my desktop that I login into remotely. Since I login remotely through Teamviewer, I have it kind of locked down. Give me a couple of days while I have some free time & I may be able to see if I can reproduce the same error that you have.

 

I used to run WSA along with HMPA and one thing I did was check after every update that WSA wasn't blocking or protecting HMPA in PC Security and Identity Protection. You can also exclude WSA in HMPA (exploit protection/all apps section).

 

Am afraid this may well be a local issue specific to your system. I have been running WRSA with HMP.A for a number of years and have never had an issue and indeed do not have one as per your description.

May I suggest that you uninstall WRSA, reboot and then clean reinstall WRSA...that may well resolve the issue you are experiencing.

Regards, Baldrick

 

Thanks for the tips Baldrick!

Like you, I've been running WSA and HMP.A together for a long time without issues so far. This is the first time I've seen them acting up against each other.

Also, I've seen this problem on multiple systems, so it's not confined to one specific setup. Uninstall / reinstall of WSA or HMP.A doesn't fix it.

I received a reply from Webroot support to check if the Identity Shield setting of WSA affects the issue and yes, If I disable WSA Identity Shield, then both Opera and Firefox start normally.

Now I just would like to know if it's more WSA's or HMP.A's issue...

 

That sounds like a good idea, so i just did those things to WSA and HPMA on my computer.

 

Hi affe

Well, as I am not seeing it I would have to say that it looks like a HMP.A issue rather than a Webroot one...but if you have responded to the Webroot Support Team that turning Identity Protection on and off does affect how the issue displays then I would have to say that you will need to wait to see what they come back to you with on that point.

What version of HMP.A are you running?

Regards, Baldrick

 

I'm trying out HMP.A and noticed the following. I was using a USB memory stick on which I was testing a few portable apps (downloaded from http://www.portableapps.com). HMP.A would not let me disconnect the USB memory stick using the portable apps interface. It kept insisting that I scan my PC for malware. It took me a lot of effort to actually manage to disconnect the USB device, because HMP.A was looping through the requirement for a scan, while I was also trying to use the program to disconnect the device!
Is there a way to put an exception in HMP.A indicating that the program being attempted to run is safe?