HitmanPro.ALERT Support and Discussion Thread

Discussion in 'other anti-malware software' started by erikloman, May 25, 2012.

  1. luckySpades

    luckySpades Registered Member

    Joined:
    Nov 26, 2013
    Posts:
    1
    Re: Support and Discussion Thread

    When i try to install HitmanPro.Alert, i always get message:

    "The instruction at "0x00411210" referenced memory at "0x0044edfc". The memory could not be "written"."

    Windows XP SP3, hardware is ok, no malware. no other security software installed, except dropmyrights.
     
  2. TomAZ

    TomAZ Registered Member

    Joined:
    Feb 27, 2010
    Posts:
    1,131
    Location:
    USA
    Re: Support and Discussion Thread

    I also have a memory problem on Windows XP SP3, but it's a little different.

    I get an error message when closing Firefox while under the supervision of Sandboxie 4.06. The error message reads as follows:


    "The instruction at "0x00318bce" referenced memory at "0x006f0071." The memory could not be "read".

    "Click on OK to terminate the program"


    Didn't have this problem with ver. 2.5.1.56. However, I have experienced it with each new release since that one. And if I revert back to 2.5.1.56, the problem goes away.
     
  3. Huwge

    Huwge Registered Member

    Joined:
    Oct 21, 2004
    Posts:
    424
    Location:
    UK
    Only just become aware of this product.

    Will it play well with ZeroVulnerabilitylabs Exploit Shield or would it replace ?

    I apologise if the question has already been asked
     
  4. J_L

    J_L Registered Member

    Joined:
    Nov 6, 2009
    Posts:
    8,738
    The only issue would be Malwarebytes Anti-Exploit blocking hmpalert_update.exe
     
  5. guest

    guest Guest

    This will be fixed soon with a new release of MBAE and they will be completely compatible.
     
  6. Huwge

    Huwge Registered Member

    Joined:
    Oct 21, 2004
    Posts:
    424
    Location:
    UK

    Thanks for the info'
     
  7. Frank the Perv

    Frank the Perv Banned

    Joined:
    Dec 16, 2005
    Posts:
    882
    Location:
    Virginia, USA
    With MBAE, would HP Alert be redundant?
     
  8. vojta

    vojta Registered Member

    Joined:
    Feb 26, 2010
    Posts:
    830
    No, you could consider MBAE your first line of defence and HMP Alert the last one.
     
  9. guest

    guest Guest

    And where would fit Secure Anywhere web protection in all this? :D
     
  10. J_L

    J_L Registered Member

    Joined:
    Nov 6, 2009
    Posts:
    8,738
  11. vojta

    vojta Registered Member

    Joined:
    Feb 26, 2010
    Posts:
    830
    I was simplifying things. I guess that a script scanner that filters web traffic, for example, should act before MBAE does.
     
  12. deugniet

    deugniet Registered Member

    Joined:
    Nov 25, 2013
    Posts:
    1,242
    From Windows Eventlog (using latest beta HmP.Alert):

    Logboeknaam: Security
    Bron: Microsoft-Windows-Security-Auditing
    Datum: 29-11-2013 13:16:37
    Gebeurtenis-id:6281
    Taakcategorie: Systeemintegriteit
    Niveau: Informatie
    Trefwoorden: Controle mislukt
    Gebruiker: n.v.t.
    Computer: sjaak2-PC
    Beschrijving:
    De paginahashes van een installatiekopiebestand zijn niet geldig. Mogelijk is het bestand onjuist ondertekend zonder paginahashes of is het bestand beschadigd vanwege een onbevoegde wijziging. De ongeldige hashes kunnen duiden op een schijffout.

    Bestandsnaam: \Device\HarddiskVolume3\Windows\System32\hmpalert.dll
    Gebeurtenis-XML:
    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
    <System>
    <Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" />
    <EventID>6281</EventID>
    <Version>0</Version>
    <Level>0</Level>
    <Task>12290</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8010000000000000</Keywords>
    <TimeCreated SystemTime="2013-11-29T12:16:37.610875900Z" />
    <EventRecordID>168580</EventRecordID>
    <Correlation />
    <Execution ProcessID="4" ThreadID="68" />
    <Channel>Security</Channel>
    <Computer>sjaak2-PC</Computer>
    <Security />
    </System>
    <EventData>
    <Data Name="param1">\Device\HarddiskVolume3\Windows\System32\hmpalert.dll</Data>
    </EventData>
    </Event>
     
  13. erikloman

    erikloman Developer

    Joined:
    Jun 4, 2009
    Posts:
    3,152
    Location:
    Hengelo, The Netherlands
    Re: Support and Discussion Thread

    I was able to reproduce. New build coming next week. Thanks for reporting :thumb:
     
  14. erikloman

    erikloman Developer

    Joined:
    Jun 4, 2009
    Posts:
    3,152
    Location:
    Hengelo, The Netherlands
    I know the cause of this. Expect a fix in next build.
     
  15. StillAlive

    StillAlive Registered Member

    Joined:
    Dec 29, 2008
    Posts:
    42
    Found a video (from a security specialist; in Russian) with tests of Bitdefender Anti-Cryptolocker and HitmanPro.Alert
    https://www.youtube.com/watch?v=SPdPwJ5YmZk

    Summary of the video: Bitdefender Anti-Cryptolocker and HitmanPro.Alert
    proved ineffective (= do not protect) against many samples of well-known (added in antiviruses databases) file ciphering malware and even malware families! For examle, Xorist ciphers all files with Bitdefender Anti-Cryptolocker or HitmanPro.Alert working in the background.


    Any comments?
     
  16. erikloman

    erikloman Developer

    Joined:
    Jun 4, 2009
    Posts:
    3,152
    Location:
    Hengelo, The Netherlands
    My Russian is kinda rusty and its a looooong video :D

    From your summary, it is correct that Alert did not block any of his tests because Alert is not meant to block malware. Alert warns when critical functions in a web browser have been compromised. Alert does not protect the computer against infection.

    HitmanPro.Alert's CryptoGuard is currently tested against *specifically* CryptoLocker and Dorifel/XDocCrypt. CryptoGuard may also work against other crypto ransomware families but we've not tested them yet.

    I will throw Xorist in our lab and see how it works.

    Thanks for pointing out the video :thumb:
     
  17. erikloman

    erikloman Developer

    Joined:
    Jun 4, 2009
    Posts:
    3,152
    Location:
    Hengelo, The Netherlands
    HitmanPro.Alert 2.5.6 Build 65 BETA

    Changelog
    • IMPROVED: CryptoGuard minifilter driver.
    • FIXED: Compatibility with Kaspersky Antivirus / Internet Security.
    • FIXED: Compatibility with Sandboxie 4.0.6.
    • FIXED: Issue related to lingering files in CryptoGuard folder.

    Download
    http://dl.surfright.nl/hmpalert25.exe

    Note that existing 2.5 users are not yet automatically updated as I would like some feedback on how the driver in this version works. Once we're confident it is stable then we will update existing 2.5 users. If that goes well, then we'll update 2.0 users at the end of the week.

    Please let me know how this version runs on your computer :thumb:
     
    Last edited: Dec 2, 2013
  18. jmonge

    jmonge Registered Member

    Joined:
    Mar 20, 2008
    Posts:
    13,744
    Location:
    Canada
    erikloman:thumb: :thumb:
     
  19. deugniet

    deugniet Registered Member

    Joined:
    Nov 25, 2013
    Posts:
    1,242
    Not fixed yet (Windows Eventlog). Also fligh out not fixed.

    Running fine latest beta.
     
  20. newyorkjet

    newyorkjet Registered Member

    Joined:
    Jan 17, 2013
    Posts:
    63
    Location:
    UK
    Win 7 (64 bit) Internet Explorer 11 and Sandboxie beta 4.07.04 - build 65 without Sandboxie does not keep opening screen (when single flyout clicked) on top od I.E. Opening screen can only be seen when I.E. minimised.

    With Sandboxie in use still getting double flyouts which do not open opening screen when clicked. Otherwise working smoothly. Thank you.
     
  21. Stupendous Man

    Stupendous Man Registered Member

    Joined:
    Aug 1, 2010
    Posts:
    2,843
    Location:
    the Netherlands
  22. deugniet

    deugniet Registered Member

    Joined:
    Nov 25, 2013
    Posts:
    1,242
  23. TomAZ

    TomAZ Registered Member

    Joined:
    Feb 27, 2010
    Posts:
    1,131
    Location:
    USA
    Seems to have corrected the Sandboxie 4.06 problem on XP.
     
  24. Gandalf_The_Grey

    Gandalf_The_Grey Registered Member

    Joined:
    Jan 31, 2012
    Posts:
    1,188
    Location:
    The Netherlands
    HitmanPro.Alert 2.5.6 Build 65 BETA running without issues here :thumb:
     
  25. jmonge

    jmonge Registered Member

    Joined:
    Mar 20, 2008
    Posts:
    13,744
    Location:
    Canada
    same here:thumb: :thumb:
     
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.