Hitman Pro Support and Discussion Thread

Re: Anyone tried out Hitman Pro?

The main reason this choice was made was to prevent false positives.

We thought that it is reasonably possible for one scanner to says it is bad and another says its white. So white overrules bad.

The chance of 4 bad, 1 white are close to none. But as we witnessed today: not impossible.

We will changes the cloud's decision patterns in the next couple of days so that this will not happen again.

 

Re: Anyone tried out Hitman Pro?

its definitely better to be safe than sorry.

 

Re: Anyone tried out Hitman Pro?

Erik, what if it were a 2/1 ratio? Or, if a "bigger" engine detects file as clean and "smaller" engine detects it as infected? Is there some kind of different "trust" levels between the engines you're using?
I too agree that it's better to be safe then sorry. I'd personally prefer black to overrides white, and this is where log and quarantine options requested few posts above would come in very handy, should a FP or FN occur.
My $0.02.

 

Re: Anyone tried out Hitman Pro?

I have to give credit where it is due, the developer of Hitman Pro is giving its userbase what it wants. Many people including myself asked for a context menu scanner and we got it. Now it fixes corrupted windows drivers and such. Bravo!! I got a couple licenses and now I need a Hitman Pro USB version to crush malware wherever I find it!

 

Re: Anyone tried out Hitman Pro?

Hi;

I hope you guys won't mind if I post here...I am using HitmanPro 3.5 Build 76 and it found it's own hitmanpro35.sys as suspicious file! It also found PDF Creator toolbar.dll in my machine as malware. I uploaded both at VirusTotal/Filterbit/Jotti's malware scan and had:

hitmanpro35.sys = not malware / not an infection
PDF Creator toolbar.dll = Trojan.Agent.ATV (CATHeal) the rest said it was clean

I submitted the files to Avira and they too said it was clean.

It seems to be false positives. I tried the "submit file as safe button" in the HitmanPro interface but it only changes to "do not delete".

Does SurfRight have a forum or a file submission scheme where users can send them sample-files for further testing?


Kind regards,

voltron

 

Re: Anyone tried out Hitman Pro?

the file has been sent dont worry, it just puts it to set as dont delete for now until it is changed, since Hitman uses a cache of all the vendors it doesnt get the changes instantly when an FP is fixed.

 

Re: Anyone tried out Hitman Pro?

My personal opinion is that it's very hard to justify marking a file as clean while the majority of the scanners you use says it's malicious. I find your reasoning really illogical. I think what the majority of the scanners detect (or don't detect) should have the heaviest weighting in the final outcome.

I have seen so many times that even VirusTotal, with all the many scanners it uses, that there are many situations where the end result is a 50/50 chance a file is either safe or malicious. And in this thread you say you white-list a file if just 1 scanner says it's safe....? Weird, just weird!

Is this the reason why I often read on forums that Hitman Pro v3 hardly ever finds malicious files on people's computers?

 

Re: Anyone tried out Hitman Pro?

As stated, in order to prevent false positives this choice was made. But it will be changed to a majority scoring. Monday the cloud will be updated. Also build 77 will be released with a few bugfixes and support for the Russian language.

Most people use tools that remove cookies and orphaned registry keys. Hitman Pro removes real threats. It isn't a cookie remover or registry cleaner (yet).

We had some issues with our NTFS reader but most problems are resolved now. Proper NTFS documentation is real hard to come by, especially stuff on how to process Attribute Lists.

 

Re: Anyone tried out Hitman Pro?

hitman is finding two xero bank files as fp....both are confirmed xb related files

 

Re: Anyone tried out Hitman Pro?

kasper, you should be able to right-click on both files and report as a false positive.

 

Re: Anyone tried out Hitman Pro?

Hi Saraceno. I am unable to right-click these detections and report as false positives. Is it because I am using the free version? It would be nice to have a detection override or ignore feature on Hitman Pro. Thanks.

 

Re: Anyone tried out Hitman Pro?

You should not right-click but left-click on the arrow at the end of the row. A context menu appears where you can report the files as false positives.

You can also expand the row by clicking on the arrow in front of the row to see which vendor flagged the file as malicious.

 

Re: Anyone tried out Hitman Pro?

i reported an FP for GhostMouse about a month ago, and its still being detected...

 

Re: Anyone tried out Hitman Pro?

Clicking (left or right) on either arrow (front or back of row) does not produce what you have stated, sorry. Nothing about reporting as a false positive... only "Delete-Do not delete", and nothing about which vendor flagged the file as malicious.

This condition exists on two computers for me. It would be nice to have a detection override or ignore feature on Hitman Pro. Thanks.

 

Re: Anyone tried out Hitman Pro?

The description says that the driver is 0 bytes in size?!? Is this actually true? It could be a dead driver that can be safely deleted...

 

Re: Anyone tried out Hitman Pro?

I have done investigation into what these files may be. Deletion is not something that I want to do at this time.

Is it possible for you to address these points...

Clicking (left or right) on either arrow (front or back of row) does not produce what you have stated, sorry. Nothing about reporting as a false positive... only "Delete-Do not delete", and nothing about which vendor flagged the file as malicious.

This condition exists on two computers for me. It would be nice to have a detection override or ignore feature on Hitman Pro. Thanks.

 

Re: Anyone tried out Hitman Pro?

"It is by design that white overrules bad. But the discussion at SurfRight has started again about this decision."

"What do you guys think what should be done if one scanner says a file is white and one other says its bad?"

Majority rules may be the best solution but the end user should be able to see which scanners are claiming something is safe or not.
How about showing a link to more info on the suspected evil doers?
Also, as has been said, an option is to also have a safety rating, though without having more info that too can backfire.
Hugger

 

Re: Anyone tried out Hitman Pro?

my FP was fixed, thx.

 

Re: Anyone tried out Hitman Pro?

Hi ;

I sent an email Hitman support and they told me that it is because that EWS is on in Hitman Pro's settings --the reason for false positives. When "unchecked" the false positives where not detected. Anyway, Build 77 seems to be stable at the moment.

voltron

 

Re: Anyone tried out Hitman Pro?

Well the last day of my trial of HMP is here.
Seriously considered buying but HMP is missing a few things that are necessary IMO.
One is a quarantine of some sort in case of a FP needing to be restored.
Another is custom scanning.(quick scan, full scan, deep scan and so on)
Guess I'll wait till HMP becomes more polished and more features are implemented.

 

Re: Anyone tried out Hitman Pro?

Support ain't so great either.

 

Re: Anyone tried out Hitman Pro?

What's wrong with support? You usually get an answer within 48 hours.

 

Re: Anyone tried out Hitman Pro?

Around here I have to ask the same question more than once before I get an answer. Email support request has gone unanswered. Prevx support answers questions in a flash. Compared to Prevx, 48 hours is an eternity.

 

Re: Anyone tried out Hitman Pro?

support has been flawless for me, i get my questions answered almost right away, wenever i need an explanation for something, i get detailed reponses with everything i need to know. i give an A+ for support personally.

 

Re: Anyone tried out Hitman Pro?

Erik,
Can you comment on this post? How accurate is this?
I too came across this few times before: Hitman would mark file as "malware" using Prevx or A-squared engine, while locally-installed Prevx or A-squared (or Virustotal's version of these engines) would report the file as clean.
How up-to-date is Hitman's cloud? Do you sync with your providers at certain intervals (which would explain some lag between detections) or do you have a direct, immediate access to the latest definitions for each engine?
Thanks!