HitmanPro.ALERT Support and Discussion Thread

Hitmanpro Detected this
is this good or badd

Code:

Properties
Name	iexplore.exe
Location	C:\Program Files (x86)\Internet Explorer
Size	731 KB
Time	-3816.0 days ago (2012-06-12 20:21:25)
Authenticode	Valid
Entropy	6.6
Product	Windows® Internet Explorer
Publisher	Microsoft Corporation
Description	Internet Explorer
Version	9.00.8112.16446
Copyright	© Microsoft Corporation. All rights reserved.
RSA Key Size	2048
SHA-256	BE7A6B1D8C731A1DC4A5185E22901943EBA552246BA41AA30646B76EAAE3AE43

Scoring (6.0)
Program is impersonating a common Windows system file. This is typical for malware.
Time indicates that the file appeared recently on this computer.
Program starts automatically without user intervention.
The file is protected by Windows File Protection (WFP). This is typical for critical Windows system files.
Program is code signed with a valid Authenticode certificate.

Startup
HKLM\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command\
HKLM\SOFTWARE\Wow6432Node\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command\

References
C:\Users\Ad\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
C:\Users\Ad\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Internet Explorer (No Add-ons).lnk
C:\Users\Ad\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
C:\Users\Stan\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
C:\Users\Stan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Internet Explorer (No Add-ons).lnk
C:\Users\Stan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
HKU\S-1-5-21-264504616-1712485042-3538728262-1000\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache\C:\Program Files (x86)\Internet Explorer\iexplore.exe
HKU\S-1-5-21-264504616-1712485042-3538728262-1001\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache\C:\Program Files (x86)\Internet Explorer\iexplore.exe

 

just a heads up, the fly out appears when opening adobe dreamweaver.

 

Yesterday, I was infected by Metropolitan Police Ukash Virus.

I ran HMP to detect this infection and I was completely shocked that HMP Pro didn't detect anything. I can tell you that Metropolitan Police Ukash Virus is an infection very common and spread on the world.

If you type Ukash virus on google, you will have 'About 371,000 results'.

I doubt that HMP scanning detection is really reliable.

 

Do you have a hash of that file in question?

Offtopic: you are posting in the wrong thread. This thread is about HitmanPro.Alert.

 

Last night, I cleaned my laptop from this infection. So I don't have anymore the infected file to check the hash file. Anyway, the infection was in the registry.

Sorry, if I posted here, Erikloman.

 

When will you release the next beta?

 

There will be a release candidate at the end of next week. A lot has changed internally. Hope you'll like it.

 

But where is the beta of the past week? Or do you skip that beta?

Which changes can we espect in the RC?

 

Not many visual changes. Most of the changes are internal. There now will only be one hmpalert.exe and a hmpalert.sys and hmpalert.dll. CPU should be lower than Beta 3b.

 

I get this sort of warning with Comodo Dragon and IE:
ntdll.dll
NlsAnsiCodePage CBDA7159

It's the only red text in the HPA list.

 

cnet2_revosetup_exe.exe
Hitman says this is malware infection. Google says its Cnet downloader

 

If this is same (MD5) file: -https://www.virustotal.com/file/a8879ead856bf505b487935ac94099a863287ec2c612eaac6a1bdf68d3d321c1/analysis/-
Or upload to VT or Jotti to check?

see: https://www.wilderssecurity.com/showthread.php?t=304653&highlight=CNET Downloader

 

It's download warper.
People at Emsisoft did create a knowledge base article about those, you can read it here: http://www.emsisoft.com/en/kb/articles/tec120224/

 

Re: Hitma thingnPro.Alert Support and Discussion Thread

Thanks guys. Seems I managed to "not accept" the Babylon thing. Just got the Revo Uninstaller I wanted.

Avira says nothing about this file being a possible threat.

 

coming soon?

 

I want to use HitmanPro.alert Where do I download it from? Also will it work if my firefox is sandboxed by sandboxie?

 

https://www.wilderssecurity.com/showpost.php?p=2061677&postcount=1

 

Thanks G.

So...

 

Yes

 

Great. Thanks.

 

And where's the RC Erik?

 

I think I will use this once it's out of beta, but will it prevent the browser from being compromised, or only alert you that it has been compromised?

 

Decided to give it a spin again. As soon as I launched Chrome, I got an alert:


USER32.dll
SetWinEventHook 002401F8
SetWindowsHookExA 00240600
SetWindowsHookExW 00240804
UnhookWinEvent 002403FC
UnhookWindowsHookEx 00240A08

ntdll.dll
LdrLoadDll 001801F8
LdrUnloadDll 001803FC
NtAllocateVirtualMemory 00180600
NtCreateSection 00180E10
NtFreeVirtualMemory 00180804
NtProtectVirtualMemory 00180A08
NtTerminateProcess 00180C0C
ZwAllocateVirtualMemory 00180600
ZwCreateSection 00180E10
ZwFreeVirtualMemory 00180804
ZwProtectVirtualMemory 00180A08
ZwTerminateProcess 00180C0C

Legitimate or not?

EDIT: Removed again. ntdll.dll was 0/43 on VT. I reinstalled Chrome and it still gave an alert.

 

This FP needs to be whitelisted.

 

It is still Beta. We are aware of some incompatibilities which will be fixed in the next released. Hope you will give the next build another run.