HitmanPro.ALERT Support and Discussion Thread

Krusty · May 6, 2020

GrDukeMalden said: ↑

Pretty much nothing, to address your post. I haven't had any issues with the notification for firefox developer edition or nightly. Does that help?
Click to expand...

No, not really. I just don't understand why you quoted my post. Maybe I'm missing something?

RonnyT · May 8, 2020

nameless said: ↑

I couldn't tolerate being without Process Hacker any longer, so I installed it. HMP was silent at first, but then began killing Process Hacker at every launch.

Process Hacker is not malware. At most, it could be considered a PUA. Microsoft doesn't consider it malware. A few malware vendors (e.g. Kaspersky) identify it as a PUA. Would it be possible to have HMP stop detecting it?

I've had to completely disable the AM module in HMP.A.
Click to expand...

On the new 871 build you can just allow these alerts, open event log via "Number of alerts" find the RED anti-malware alerts you wish to allow -> action -> suppress alert.

RonnyT · May 8, 2020

paulderdash said: ↑

Should one protect WhatsApp desktop, and if so, which template ...'Other'?
Click to expand...

Yes won't hurt to do so, but beware after every update they change path/version name stuff so you'll have to add it again.

RonnyT · May 8, 2020

Krusty said: ↑

Auto-updated here without issue x 2.

Edit: Still no green fly-out when opening Firefox 75.
Click to expand...

That's a norton thingy, won't be fixed either I'm afraid, sometime is does, sometimes it doesn't, app is still protected.

maniac2003 · May 9, 2020

M_G_H said: ↑

I'm having the same issues in Windows 10 Mail app. Need to turn off key encryption to write anything legible.
Click to expand...

RonnyT said: ↑

On what profile is the Win10 Mail app protected? e.g. Browser/Media/Office/Other?
Click to expand...

Ok, somehow it works normal again at my end. The app isn't listed, no fly-out when started.

ETchat10 · May 10, 2020

On Windows XP, Java application (javaw.exe) protected with Java template, is reported in HitmanPro.Alert as "not protected".
Tested with Java version 8 Update 251, and Java version 7 Update 80; and HitmanPro.Alert 3.8.4 Build 871

deugniet · May 15, 2020

CredGuard Reboot Restore RX. HitmanPro.Alert build 871.

GrDukeMalden · May 20, 2020

Protected applications aren't listed in the running applications menu when they're minimized to the taskbar tray. Are they still protected while they're only running in the tray?

Page42 · May 20, 2020

GrDukeMalden said: ↑

Protected applications aren't listed in the running applications menu when they're minimized to the taskbar tray. Are they still protected while they're only running in the tray?
Click to expand...

On my 7x64 machines, protected applications are listed in the running applications menu when they are minimized to the taskbar tray.

GrDukeMalden · May 20, 2020

Page42 said: ↑

On my 7x64 machines, protected applications are listed in the running applications menu when they are minimized to the taskbar tray.
Click to expand...

I'm running windows 10 home x64. So is it just a cosmetic issue or is there a problem with the protection?

Krusty · May 20, 2020

GrDukeMalden said: ↑

Protected applications aren't listed in the running applications menu when they're minimized to the taskbar tray. Are they still protected while they're only running in the tray?
Click to expand...

I just checked with Firefox 76.0.1 minimised and it showed as a running application in HMP.A

GrDukeMalden · May 20, 2020

Krusty said: ↑

I just checked with Firefox 76.0.1 minimised and it showed as a running application in HMP.A
Click to expand...

not just minimized. When a protected application is minimized to the taskbar tray. not just the taskbar. But the taskbar tray. it will no longer show up in the list of running applications that are protected.

For example Steam, Onedrive and megasync. I added them to the list of protected applications but they never show in the list of running applications that are also protected when they're down in the taskbar tray.

Krusty · May 20, 2020

GrDukeMalden said: ↑

not just minimized. When a protected application is minimized to the taskbar tray. not just the taskbar. But the taskbar tray. it will no longer show up in the list of running applications that are protected.

For example Steam, Onedrive and megasync. I added them to the list of protected applications but they never show in the list of running applications that are also protected when they're down in the taskbar tray.
Click to expand...

OK, yeah you're right. I just checked with another program that has a tray icon. Once minimised to the tray it does not show as a running program.

guest · May 20, 2020

There is not a problem with the protection.
A protected application stays protected even if it is minimized and isn't shown in the list of running applications.

GrDukeMalden · May 20, 2020

mood said: ↑

There is not a problem with the protection.
A protected application stays protected even if it is minimized and isn't shown in the list of running applications.
Click to expand...

Thankyou

akhsj · May 24, 2020

Is there any way to add an exception or whitelist an executable from CryptoGuard v5? I did not see a setting in the menu to do that.

On my system CryptoGuard v5 is detecting a false positive "Generic.Ransom.C" for Backblaze bztransmit64.exe, and terminating the process and restoring the file state. I can manually unblock the executable each time, but it will just get blocked again. The files bztransmit64 is modifying are all within the expected Backblaze data directory, so part of its normal operation.

This is the current download of HitmanPro.Alert version 3.8.4 build 871 (licensed) on fully updated Windows 10 Pro version 1909 with latest Backblaze 7.0.1 client

Alert details:
Platform 10.0.18363/x64 v871 06_3a
Application C:\Program Files (x86)\Backblaze\x64\bztransmit64.exe
Description bztransmit64.exe 7.0.1
Detection Generic.Ransom.C
Mitigation CryptoGuard
The application has accessed and encrypted multiple productivity files (documents, photos and similar file types). This is indicative of a crypto-ransomware attack. The manipulated files were restored to their original state.

[edited - moved question to top]

paulderdash · May 25, 2020

akhsj said: ↑

Is there any way to add an exception or whitelist an executable from CryptoGuard v5? I did not see a setting in the menu to do that.

On my system CryptoGuard v5 is detecting a false positive "Generic.Ransom.C" for Backblaze bztransmit64.exe, and terminating the process and restoring the file state. I can manually unblock the executable each time, but it will just get blocked again. The files bztransmit64 is modifying are all within the expected Backblaze data directory, so part of its normal operation.

This is the current download of HitmanPro.Alert version 3.8.4 build 871 (licensed) on fully updated Windows 10 Pro version 1909 with latest Backblaze 7.0.1 client

Alert details:
Platform 10.0.18363/x64 v871 06_3a
Application C:\Program Files (x86)\Backblaze\x64\bztransmit64.exe
Description bztransmit64.exe 7.0.1
Detection Generic.Ransom.C
Mitigation CryptoGuard
The application has accessed and encrypted multiple productivity files (documents, photos and similar file types). This is indicative of a crypto-ransomware attack. The manipulated files were restored to their original state.

[edited - moved question to top]
Click to expand...

@akhsj You could try the following, if you haven't already?

Settings>Advanced Interface
Exploit mitigation>Applications
Rightmost side of that tile ... Exclude>+ Add exclusion (at the end) ... navigate to C:\Program Files (x86)\Backblaze\x64\bztransmit64.exe and select ...

For Applications I trust (especially security applications, but also backup applications if there was a problem), I tend to exclude all. exes in the Program directory.

RonnyT · May 25, 2020

akhsj said: ↑

Is there any way to add an exception or whitelist an executable from CryptoGuard v5? I did not see a setting in the menu to do that.

On my system CryptoGuard v5 is detecting a false positive "Generic.Ransom.C" for Backblaze bztransmit64.exe, and terminating the process and restoring the file state. I can manually unblock the executable each time, but it will just get blocked again. The files bztransmit64 is modifying are all within the expected Backblaze data directory, so part of its normal operation.

This is the current download of HitmanPro.Alert version 3.8.4 build 871 (licensed) on fully updated Windows 10 Pro version 1909 with latest Backblaze 7.0.1 client

Alert details:
Platform 10.0.18363/x64 v871 06_3a
Application C:\Program Files (x86)\Backblaze\x64\bztransmit64.exe
Description bztransmit64.exe 7.0.1
Detection Generic.Ransom.C
Mitigation CryptoGuard
The application has accessed and encrypted multiple productivity files (documents, photos and similar file types). This is indicative of a crypto-ransomware attack. The manipulated files were restored to their original state.

[edited - moved question to top]
Click to expand...

We will be tweaking the CG5 engine with the next release, but in the mean time you can use the "suppress alert" feature for this.
First "Unblock" the locked Blackblaze executable, and after that click on "number of alerts" to open de new eventlog find the CG5 alert -> Action -> Suppress Alert.

This should take care of Blackblaze triggering CG5 alerts.

akhsj · May 25, 2020

RonnyT said: ↑

in the mean time you can use the "suppress alert" feature for this. ... This should take care of Blackblaze triggering CG5 alerts.
Click to expand...

@RonnyT - So "Suppress Alert" actually whitelists the alert to prevent this detection / termination behavior for this process? The feature sounds like it just stops reporting the alerts it detects.

@paulderdash - Thanks. Just tried your suggestion, but CG5 still detected a false positive. CG5 does not appear to use that application exclusion list.

For now I have changed the configuration to CryptoGuard v4, and currently that appears to be working.

RonnyT · May 25, 2020

akhsj said: ↑

@RonnyT - So "Suppress Alert" actually whitelists the alert to prevent this detection / termination behavior for this process?
Click to expand...

Correct

akhsj · May 25, 2020

@RonnyT - thanks. So I switched back to CG5, suppressed the alert, and forced a backup sync. The forced backup sync worked without issue. I'll see what happens over the next few days.

Krusty · May 26, 2020

False Positive:

Code:

Mitigation   Lockdown
Timestamp    2020-05-27T01:33:15

Platform     10.0.18363/x64 v871 06_5e
PID          10296
Feature      003D0A36000001B6
Application  C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\Modules\HPSSFUpdater.exe
Created      2019-08-11T06:13:13
Description  HPSSFUpdater 8.8.1

Filename     C:\Users\David\AppData\Local\Temp\tmpC731.tmp.bat
Created By   C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\Modules\HPSSFUpdater.exe

Command line:
"C:\Users\David\AppData\Local\Temp\tmpC731.tmp.bat" "C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\Modules\HPSSFUpdater\HPSSFUpdater.exe" "C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\Modules\HPSSFUpdater.exe" "hpssfupdater_tmpC731.tmp" "C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\Modules\hpssfupdater_tmpC731.tmp" "C:\Users\David\AppData\Local\Temp\hpssfupdater_tmpC731.tmp"

Loaded Modules (106)
-----------------------------------------------------------------------------
0000000000660000-0000000000704000 HPSSFUpdater.exe (HP Inc.),
                                  version: 8.8.1.2
00007FFE16B00000-00007FFE16CF0000 ntdll.dll (Microsoft Corporation),
                                  version: 10.0.18362.815 (WinBuild.160101.0800)
00007FFE15C70000-00007FFE15D22000 KERNEL32.dll (Microsoft Corporation),
                                  version: 10.0.18362.778 (WinBuild.160101.0800)
00007FFE01150000-00007FFE011B4000 MSCOREE.DLL (Microsoft Corporation),
                                  version: 10.0.18362.1 (WinBuild.160101.0800)
00007FFE14590000-00007FFE14834000 KERNELBASE.dll (Microsoft Corporation),
                                  version: 10.0.18362.815 (WinBuild.160101.0800)
00007FFE136F0000-00007FFE13808000 hmpalert.dll (SurfRight B.V.),
                                  version: 3.8.4.871
00007FFE160C0000-00007FFE16163000 ADVAPI32.dll (Microsoft Corporation),
                                  version: 10.0.18362.752 (WinBuild.160101.0800)
00007FFE169E0000-00007FFE16A7E000 msvcrt.dll (Microsoft Corporation),
                                  version: 7.0.18362.1 (WinBuild.160101.0800)
00007FFE16170000-00007FFE16207000 sechost.dll (Microsoft Corporation),
                                  version: 10.0.18362.693 (WinBuild.160101.0800)
00007FFE168C0000-00007FFE169E0000 RPCRT4.dll (Microsoft Corporation),
                                  version: 10.0.18362.628 (WinBuild.160101.0800)
00007FFE00B70000-00007FFE00C1A000 mscoreei.dll (Microsoft Corporation),
                                  version: 4.8.4180.0 built by: NET48REL1LAST_B
00007FFE15D30000-00007FFE15D82000 SHLWAPI.dll (Microsoft Corporation),
                                  version: 10.0.18362.1 (WinBuild.160101.0800)
00007FFE15450000-00007FFE15786000 combase.dll (Microsoft Corporation),
                                  version: 10.0.18362.815 (WinBuild.160101.0800)
00007FFE14490000-00007FFE1458A000 ucrtbase.dll (Microsoft Corporation),
                                  version: 10.0.18362.815 (WinBuild.160101.0800)
00007FFE14B30000-00007FFE14BB0000 bcryptPrimitives.dll (Microsoft Corporation),
                                  version: 10.0.18362.836 (WinBuild.160101.0800)
00007FFE16830000-00007FFE16856000 GDI32.dll (Microsoft Corporation),
                                  version: 10.0.18362.1 (WinBuild.160101.0800)
00007FFE14890000-00007FFE148B1000 win32u.dll (Microsoft Corporation),
                                  version: 10.0.18362.836 (WinBuild.160101.0800)
00007FFE148C0000-00007FFE14A54000 gdi32full.dll (Microsoft Corporation),
                                  version: 10.0.18362.836 (WinBuild.160101.0800)
00007FFE13A90000-00007FFE13B2E000 msvcp_win.dll (Microsoft Corporation),
                                  version: 10.0.18362.815 (WinBuild.160101.0800)
00007FFE15970000-00007FFE15B04000 USER32.dll (Microsoft Corporation),
                                  version: 10.0.18362.836 (WinBuild.160101.0800)
00007FFE16A90000-00007FFE16ABE000 IMM32.DLL (Microsoft Corporation),
                                  version: 10.0.18362.387 (WinBuild.160101.0800)
00007FFE139D0000-00007FFE139E1000 kernel.appcore.dll (Microsoft Corporation),
                                  version: 10.0.18362.1 (WinBuild.160101.0800)
00007FFE03CB0000-00007FFE03CBA000 VERSION.dll (Microsoft Corporation),
                                  version: 10.0.18362.1 (WinBuild.160101.0800)
00007FFDFC120000-00007FFDFCBE1000 clr.dll (Microsoft Corporation),
                                  version: 4.8.4180.0 built by: NET48REL1LAST_B
00007FFDFE8C0000-00007FFDFE8D6000 VCRUNTIME140_CLR0400.dll (Microsoft Corporation),
                                  version: 14.10.25028.0 built by: VCTOOLSD15RTM
00007FFDFE170000-00007FFDFE22D000 ucrtbase_clr0400.dll (Microsoft Corporation),
                                  version: 14.10.25028.0 built by: VCTOOLSD15RTM
00007FFE15B10000-00007FFE15B18000 psapi.dll (Microsoft Corporation),
                                  version: 10.0.18362.1 (WinBuild.160101.0800)
00007FFDCE660000-00007FFDCFC60000 mscorlib.ni.dll (Microsoft Corporation),
                                  version: 4.8.4180.0 built by: NET48REL1LAST_B
00007FFE15F60000-00007FFE160B7000 ole32.dll (Microsoft Corporation),
                                  version: 10.0.18362.693 (WinBuild.160101.0800)
00007FFE11C10000-00007FFE11CA9000 uxtheme.dll (Microsoft Corporation),
                                  version: 10.0.18362.449 (WinBuild.160101.0800)
00007FFDFE020000-00007FFDFE16E000 clrjit.dll (Microsoft Corporation),
                                  version: 4.8.4180.0 built by: NET48REL1LAST_B
00007FFDFAE20000-00007FFDFBA90000 System.ni.dll (Microsoft Corporation),
                                  version: 4.8.4001.0 built by: NET48REL1LAST_C
00007FFDF6AD0000-00007FFDF6CC4000 System.Drawing.ni.dll (Microsoft Corporation),
                                  version: 4.8.3752.0 built by: NET48REL1
00007FFDC8C70000-00007FFDC9D16000 System.Windows.Forms.ni.dll (Microsoft Corporation),
                                  version: 4.8.4150.0 built by: NET48REL1LAST_C
00007FFDFA020000-00007FFDFAA95000 System.Core.ni.dll (Microsoft Corporation),
                                  version: 4.8.4180.0 built by: NET48REL1LAST_B
00007FFDFBFE0000-00007FFDFC113000 System.Configuration.ni.dll (Microsoft Corporation),
                                  version: 4.8.3752.0 built by: NET48REL1
00007FFDE2B90000-00007FFDE343B000 System.Xml.ni.dll (Microsoft Corporation),
                                  version: 4.8.3752.0 built by: NET48REL1
00007FFE14D60000-00007FFE15444000 shell32.dll (Microsoft Corporation),
                                  version: 10.0.18362.815 (WinBuild.160101.0800)
00007FFE14840000-00007FFE1488A000 cfgmgr32.dll (Microsoft Corporation),
                                  version: 10.0.18362.387 (WinBuild.160101.0800)
00007FFE158C0000-00007FFE15969000 shcore.dll (Microsoft Corporation),
                                  version: 10.0.18362.836 (WinBuild.160101.0800)
00007FFE13BC0000-00007FFE1433E000 windows.storage.dll (Microsoft Corporation),
                                  version: 10.0.18362.836 (WinBuild.160101.0800)
00007FFE13A60000-00007FFE13A83000 profapi.dll (Microsoft Corporation),
                                  version: 10.0.18362.693 (WinBuild.160101.0800)
00007FFE139F0000-00007FFE13A3A000 powrprof.dll (Microsoft Corporation),
                                  version: 10.0.18362.1 (WinBuild.160101.0800)
00007FFE139C0000-00007FFE139D0000 UMPDC.dll (),
                                  version:
00007FFE14A60000-00007FFE14A77000 cryptsp.dll (Microsoft Corporation),
                                  version: 10.0.18362.1 (WinBuild.160101.0800)
00007FFE13B90000-00007FFE13BB6000 bcrypt.dll (Microsoft Corporation),
                                  version: 10.0.18362.267 (WinBuild.160101.0800)
00007FFE12C20000-00007FFE12C53000 rsaenh.dll (Microsoft Corporation),
                                  version: 10.0.18362.1 (WinBuild.160101.0800)
00007FFE13280000-00007FFE1328C000 CRYPTBASE.dll (Microsoft Corporation),
                                  version: 10.0.18362.1 (WinBuild.160101.0800)
00007FFDF95C0000-00007FFDF9ACF000 WindowsBase.ni.dll (Microsoft Corporation),
                                  version: 4.8.4180.0 built by: NET48REL1LAST_B
00007FFE12DC0000-00007FFE12DFA000 iphlpapi.dll (Microsoft Corporation),
                                  version: 10.0.18362.1 (WinBuild.160101.0800)
00007FFE12E10000-00007FFE12EDB000 DNSAPI.dll (Microsoft Corporation),
                                  version: 10.0.18362.815 (WinBuild.160101.0800)
00007FFE15C00000-00007FFE15C6F000 WS2_32.dll (Microsoft Corporation),
                                  version: 10.0.18362.387 (WinBuild.160101.0800)
00007FFE16A80000-00007FFE16A88000 NSI.dll (Microsoft Corporation),
                                  version: 10.0.18362.449 (WinBuild.160101.0800)
00007FFE0A190000-00007FFE0A1A6000 dhcpcsvc6.DLL (Microsoft Corporation),
                                  version: 10.0.18362.815 (WinBuild.160101.0800)
00007FFE0C1D0000-00007FFE0C1EC000 dhcpcsvc.DLL (Microsoft Corporation),
                                  version: 10.0.18362.815 (WinBuild.160101.0800)
00007FFE0D7D0000-00007FFE0D7DB000 WINNSI.DLL (Microsoft Corporation),
                                  version: 10.0.18362.449 (WinBuild.160101.0800)
00007FFDF6820000-00007FFDF690F000 rasapi32.dll (Microsoft Corporation),
                                  version: 10.0.18362.387 (WinBuild.160101.0800)
00007FFDF67E0000-00007FFDF6813000 rasman.dll (Microsoft Corporation),
                                  version: 10.0.18362.1 (WinBuild.160101.0800)
00007FFE05F60000-00007FFE05F75000 rtutils.dll (Microsoft Corporation),
                                  version: 10.0.18362.657 (WinBuild.160101.0800)
00007FFE130B0000-00007FFE13117000 mswsock.dll (Microsoft Corporation),
                                  version: 10.0.18362.815 (WinBuild.160101.0800)
00007FFE09C60000-00007FFE09D50000 winhttp.dll (Microsoft Corporation),
                                  version: 10.0.18362.778 (WinBuild.160101.0800)
00007FFE09740000-00007FFE0974A000 rasadhlp.dll (Microsoft Corporation),
                                  version: 10.0.18362.1 (WinBuild.160101.0800)
00007FFE0A040000-00007FFE0A0B7000 fwpuclnt.dll (Microsoft Corporation),
                                  version: 10.0.18362.207 (WinBuild.160101.0800)
00007FFDFD9E0000-00007FFDFD9EC000 secur32.dll (Microsoft Corporation),
                                  version: 10.0.18362.1 (WinBuild.160101.0800)
00007FFE138B0000-00007FFE138DF000 SSPICLI.DLL (Microsoft Corporation),
                                  version: 10.0.18362.1 (WinBuild.160101.0800)
00007FFE12B50000-00007FFE12BD8000 schannel.DLL (Microsoft Corporation),
                                  version: 10.0.18362.418 (WinBuild.160101.0800)
00007FFE14340000-00007FFE14489000 CRYPT32.dll (Microsoft Corporation),
                                  version: 10.0.18362.592 (WinBuild.160101.0800)
00007FFE13A40000-00007FFE13A52000 MSASN1.dll (Microsoft Corporation),
                                  version: 10.0.18362.1 (WinBuild.160101.0800)
00007FFDF4040000-00007FFDF4055000 mskeyprotect.dll (Microsoft Corporation),
                                  version: 10.0.18362.1 (WinBuild.160101.0800)
00007FFE133E0000-00007FFE13406000 ncrypt.dll (Microsoft Corporation),
                                  version: 10.0.18362.1 (WinBuild.160101.0800)
00007FFE133A0000-00007FFE133DB000 NTASN1.dll (Microsoft Corporation),
                                  version: 10.0.18362.1 (WinBuild.160101.0800)
00007FFDF40F0000-00007FFDF4115000 ncryptsslp.dll (Microsoft Corporation),
                                  version: 10.0.18362.1 (WinBuild.160101.0800)
00007FFE04880000-00007FFE04D55000 wininet.dll (Microsoft Corporation),
                                  version: 11.00.18362.753 (WinBuild.160101.0800)
00007FFE09780000-00007FFE09A26000 iertutil.dll (Microsoft Corporation),
                                  version: 11.00.18362.815 (WinBuild.160101.0800)
00007FFE15B30000-00007FFE15BF4000 OLEAUT32.dll (Microsoft Corporation),
                                  version: 10.0.18362.836 (WinBuild.160101.0800)
00007FFE13B30000-00007FFE13B8C000 wintrust.dll (Microsoft Corporation),
                                  version: 10.0.18362.387 (WinBuild.160101.0800)
00007FFE124C0000-00007FFE124E2000 gpapi.dll (Microsoft Corporation),
                                  version: 10.0.18362.1 (WinBuild.160101.0800)
00007FFE15F40000-00007FFE15F5D000 imagehlp.dll (Microsoft Corporation),
                                  version: 10.0.18362.1 (WinBuild.160101.0800)
00007FFE09A30000-00007FFE09C06000 urlmon.dll (Microsoft Corporation),
                                  version: 11.00.18362.815 (WinBuild.160101.0800)
00007FFE10250000-00007FFE10340000 PROPSYS.dll (Microsoft Corporation),
                                  version: 7.0.18362.815 (WinBuild.160101.0800)
00007FFE16780000-00007FFE16822000 clbcatq.dll (Microsoft Corporation),
                                  version: 2001.12.10941.16384 (WinBuild.160101.080
00007FFDFE8E0000-00007FFDFE8F6000 BitsProxy.dll (Microsoft Corporation),
                                  version: 7.8.18362.1 (WinBuild.160101.0800)
00007FFDF2080000-00007FFDF21E6000 System.Management.ni.dll (Microsoft Corporation),
                                  version: 4.8.3752.0 built by: NET48REL1
00007FFE09750000-00007FFE09776000 wmiutils.dll (Microsoft Corporation),
                                  version: 10.0.18362.1 (WinBuild.160101.0800)
00007FFE09DD0000-00007FFE09E54000 wbemcomn.dll (Microsoft Corporation),
                                  version: 10.0.18362.1 (WinBuild.160101.0800)
00007FFE09E60000-00007FFE09E71000 wbemprox.dll (Microsoft Corporation),
                                  version: 10.0.18362.1 (WinBuild.160101.0800)
00007FFE00130000-00007FFE00160000 wminet_utils.dll (Microsoft Corporation),
                                  version: 4.8.3752.0 built by: NET48REL1
00007FFE09E90000-00007FFE09EA4000 wbemsvc.dll (Microsoft Corporation),
                                  version: 10.0.18362.1 (WinBuild.160101.0800)
00007FFE05250000-00007FFE05351000 fastprox.dll (Microsoft Corporation),
                                  version: 10.0.18362.1 (WinBuild.160101.0800)
00007FFE09D50000-00007FFE09D65000 amsi.dll (Microsoft Corporation),
                                  version: 10.0.18362.1 (WinBuild.160101.0800)
00007FFE138E0000-00007FFE13905000 USERENV.dll (Microsoft Corporation),
                                  version: 10.0.18362.387 (WinBuild.160101.0800)
00007FFE05120000-00007FFE051CE000 symamsi.dll (Symantec Corporation),
                                  version: 15.7.10.10
00007FFDFAC60000-00007FFDFAD08000 webengine4.dll (Microsoft Corporation),
                                  version: 4.8.4075.0 built by: NET48REL1LAST
00007FFE10000000-00007FFE100BB000 taskschd.dll (Microsoft Corporation),
                                  version: 10.0.18362.752 (WinBuild.160101.0800)
00007FFDE8B70000-00007FFDE8B93000 edputil.dll (Microsoft Corporation),
                                  version: 10.0.18362.1 (WinBuild.160101.0800)
00007FFDF4ED0000-00007FFDF5005000 Windows.StateRepositoryPS.dll (Microsoft Corporation),
                                  version: 10.0.18362.836 (WinBuild.160101.0800)
00007FFE017C0000-00007FFE017E0000 CLDAPI.dll (Microsoft Corporation),
                                  version: 10.0.18362.1 (WinBuild.160101.0800)
00007FFDF4390000-00007FFDF439A000 FLTLIB.DLL (Microsoft Corporation),
                                  version: 10.0.18362.1 (WinBuild.160101.0800)
00007FFE0F560000-00007FFE0F6B3000 wintypes.dll (Microsoft Corporation),
                                  version: 10.0.18362.836 (WinBuild.160101.0800)
00007FFDE8A90000-00007FFDE8B23000 appresolver.dll (Microsoft Corporation),
                                  version: 10.0.18362.356 (WinBuild.160101.0800)
00007FFE092E0000-00007FFE0933D000 Bcp47Langs.dll (Microsoft Corporation),
                                  version: 10.0.18362.657 (WinBuild.160101.0800)
00007FFE127B0000-00007FFE127D7000 SLC.dll (Microsoft Corporation),
                                  version: 10.0.18362.815 (WinBuild.160101.0800)
00007FFE12780000-00007FFE127A6000 sppc.dll (Microsoft Corporation),
                                  version: 10.0.18362.815 (WinBuild.160101.0800)
00007FFDEE7B0000-00007FFDEE829000 OneCoreCommonProxyStub.dll (Microsoft Corporation),
                                  version: 10.0.18362.1 (WinBuild.160101.0800)
00007FFE0E590000-00007FFE0ECFD000 OneCoreUAPCommonProxyStub.dll (Microsoft Corporation),
                                  version: 10.0.18362.752 (WinBuild.160101.0800)
00007FFE11B10000-00007FFE11B9F000 apphelp.dll (Microsoft Corporation),
                                  version: 10.0.18362.1 (WinBuild.160101.0800)

Process Trace
1  C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\Modules\HPSSFUpdater.exe [10296] 2020-05-27T01:32:41
   "C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\Modules\HPSSFUpdater.exe" /r
2  C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [3140] 2020-05-27T01:32:37
   "C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe" /L Analysis
3  C:\Windows\System32\svchost.exe [1160] 2020-05-26T23:43:17
   C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
4  C:\Windows\System32\services.exe [796] 2020-05-26T23:43:16
5  C:\Windows\System32\wininit.exe [696] 2020-05-26T23:43:16
   wininit.exe
6  C:\Windows\System32\smss.exe [488] 2020-05-26T23:43:14 2.1s
   \SystemRoot\System32\smss.exe 000000d0 00000084
7  C:\Windows\System32\smss.exe [384] 2020-05-26T23:43:13
   \SystemRoot\System32\smss.exe

Dropped Files
1  C:\Users\David\AppData\Local\Temp\HPSSFUpdater\HPSSFConfig.cab
     Dropped by \Device\HarddiskVolume4\Program Files (x86)\Hewlett-Packard\HP Support Solutions\Modules\HPSSFUpdater.exe [10296]
        Read by \Device\HarddiskVolume4\Program Files (x86)\Hewlett-Packard\HP Support Solutions\Modules\HPSSFUpdater.exe [10296]
                \Device\HarddiskVolume4\Program Files (x86)\Hewlett-Packard\HP Support Solutions\Modules\unzip.exe [9776]
2  C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\Modules\HPSSF_Modules.xml
     Dropped by \Device\HarddiskVolume4\Program Files (x86)\Hewlett-Packard\HP Support Solutions\Modules\HPSSFUpdater.exe [10296]
3  C:\Users\David\AppData\Local\Temp\tmpC731.tmp
     Dropped by \Device\HarddiskVolume4\Program Files (x86)\Hewlett-Packard\HP Support Solutions\Modules\HPSSFUpdater.exe [10296]
4  C:\Users\David\AppData\Local\Temp\tmpC731.tmp.bat
     Dropped by \Device\HarddiskVolume4\Program Files (x86)\Hewlett-Packard\HP Support Solutions\Modules\HPSSFUpdater.exe [10296]
1  C:\Users\David\AppData\Local\Temp\HP Support Framework\HPSF_Config1.dll
     Dropped by \Device\HarddiskVolume4\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [3140]
2  C:\ProgramData\Hewlett-Packard\HP Support Framework\Resources\HPSFMessenger\HPSFMsgrStatus.xml
     Dropped by \Device\HarddiskVolume4\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [3140]

Thumbprints
24aa0714cc41db944957736cc1e49259b99bd3fecee36d95696e83701c2171e9

Thanks.

cantoris · May 28, 2020

Upgraded my PC to Windows 10 v2004 and immediately got blue screen loops from hmpalert.sys occurring at the logon screen.
Booted to safe mode, uninstalled HitManPro.Alert and now all appears well.
Not tried reinstalling it yet...

XIII · May 28, 2020

Also upgraded to 2004 (this morning), no BSOD (HMP.Alert was even active during the upgrade).

deugniet · May 28, 2020

XIII said: ↑

Also upgraded to 2004 (this morning), no BSOD (HMP.Alert was even active during the upgrade).
Click to expand...

Same here.

Log in or Sign up

HitmanPro.ALERT Support and Discussion Thread

Krusty Registered Member

RonnyT QA Engineer

RonnyT QA Engineer

RonnyT QA Engineer

maniac2003 Registered Member

ETchat10 Registered Member

deugniet Registered Member

Attached Files:

CredGuard.txt

GrDukeMalden Registered Member

Page42 Registered Member

GrDukeMalden Registered Member

Krusty Registered Member

GrDukeMalden Registered Member

Krusty Registered Member

guest Guest

GrDukeMalden Registered Member

akhsj Registered Member

paulderdash Registered Member

RonnyT QA Engineer

akhsj Registered Member

RonnyT QA Engineer

akhsj Registered Member

Krusty Registered Member

cantoris Registered Member

XIII Registered Member

deugniet Registered Member

Log in or Sign up

HitmanPro.ALERT Support and Discussion Thread

Krusty Registered Member

RonnyT QA Engineer

RonnyT QA Engineer

RonnyT QA Engineer

maniac2003 Registered Member

ETchat10 Registered Member

deugniet Registered Member

Attached Files:

CredGuard.txt

GrDukeMalden Registered Member

Page42 Registered Member

GrDukeMalden Registered Member

Krusty Registered Member

GrDukeMalden Registered Member

Krusty Registered Member

guest Guest

GrDukeMalden Registered Member

akhsj Registered Member

paulderdash Registered Member

RonnyT QA Engineer

akhsj Registered Member

RonnyT QA Engineer

akhsj Registered Member

Krusty Registered Member

cantoris Registered Member

XIII Registered Member

deugniet Registered Member

Useful Searches