HitmanPro.ALERT Support and Discussion Thread

Discussion in 'other anti-malware software' started by erikloman, May 25, 2012.

Page 180 of 679
  1. erikloman

    erikloman Developer

    Joined:
    Jun 4, 2009
    Posts:
    3,152
    Location:
    Hengelo, The Netherlands
    A few questions to get this ironed out:
    • What version of Windows are you running?
    • What AV are you using?
    • What other security products are you using?
    Make sure you are running build 167 (or newer).
     
    Last edited: Mar 16, 2015
    erikloman, Mar 16, 2015
    #4476
  2. deugniet

    deugniet Registered Member

    Joined:
    Nov 25, 2013
    Posts:
    1,244
    Appcrash hmpalert.exe (W7 64 bits/build 167).

    Logboeknaam: Application
    Bron: Windows Error Reporting
    Datum: 16-3-2015 7:53:53
    Gebeurtenis-id:1001
    Taakcategorie: Geen
    Niveau: Informatie
    Trefwoorden: Klassiek
    Gebruiker: n.v.t.
    Computer: ****
    Beschrijving:
    Foutbucket 919660272, type 17
    Naam van gebeurtenis: APPCRASH
    Antwoord: Niet beschikbaar
    Id van CAB-bestand: 0

    Handtekening van probleem:
    P1: hmpalert.exe
    P2: 3.0.32.167
    P3: 55005fb5
    P4: unknown
    P5: 0.0.0.0
    P6: 00000000
    P7: 00000000
    P8: 00000000
    P9:
    P10:

    Bijgevoegde bestanden:
    C:\Windows\Temp\WER55BD.tmp.appcompat.txt
    C:\Windows\Temp\WER566A.tmp.WERInternalMetadata.xml
    C:\Windows\Temp\WER5764.tmp.WERDataCollectionFailure.txt

    Deze bestanden zijn mogelijk hier beschikbaar:
    C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_hmpalert.exe_eb9184e45586dcac87d5a569a318b15ae54ed_0288c5dd

    Analysesymbool:
    Opnieuw zoeken naar oplossing: 0nRapport-id: 01226324-cae4-11e4-87b4-001f16aa0c13
    Rapportstatus: 0
    Gebeurtenis-XML:
    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
    <System>
    <Provider Name="Windows Error Reporting" />
    <EventID Qualifiers="0">1001</EventID>
    <Level>4</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2015-03-16T06:53:53.000000000Z" />
    <EventRecordID>163826</EventRecordID>
    <Channel>Application</Channel>
    <Computer>****2-PC</Computer>
    <Security />
    </System>
    <EventData>
    <Data>919660272</Data>
    <Data>17</Data>
    <Data>APPCRASH</Data>
    <Data>Niet beschikbaar</Data>
    <Data>0</Data>
    <Data>hmpalert.exe</Data>
    <Data>3.0.32.167</Data>
    <Data>55005fb5</Data>
    <Data>unknown</Data>
    <Data>0.0.0.0</Data>
    <Data>00000000</Data>
    <Data>00000000</Data>
    <Data>00000000</Data>
    <Data>
    </Data>
    <Data>
    </Data>
    <Data>
    C:\Windows\Temp\WER55BD.tmp.appcompat.txt
    C:\Windows\Temp\WER566A.tmp.WERInternalMetadata.xml
    C:\Windows\Temp\WER5764.tmp.WERDataCollectionFailure.txt</Data>
    <Data>C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_hmpalert.exe_eb9184e45586dcac87d5a569a318b15ae54ed_0288c5dd</Data>
    <Data>
    </Data>
    <Data>0</Data>
    <Data>01226324-cae4-11e4-87b4-001f16aa0c13</Data>
    <Data>0</Data>
    </EventData>
    </Event>
     
    deugniet, Mar 16, 2015
    #4477
  3. PallMall

    PallMall Guest

    Licensed HitmanPro/HitmanPro.Alert 3.0.30.167 running fine on Windows 7 x64 Premium
    -
    I started with HitmanPro.Alert 3.0.30.155 then updated to HitmanPro.Alert 3.0.30.167, with either version no problem... except one small issue regarding an application which had been included with the very first post-install first scan. The application is XMPlay.exe and it initiates an alert when run until I disable one and one only mitigation : its Control-Flow integrity.

    This exception for XMPlay.exe's Control-Flow Integrity is the only exception I've had to perform and all other settings are default ones.
    I've added Thunderbird.exe with the Office template as recommended by erikloman plus two other applications under the Media mitigation template (mpc-be64.exe and winyl.exe).

    No problems to put it mildly when Hitman.pro.Alert 3 is, as far as I'm concerned, a piece of art :)
     
    Last edited by a moderator: Mar 16, 2015
    PallMall, Mar 16, 2015
    #4478
  4. 142395

    142395 Guest

    I personally prefer separate products or option for uninstalling unneeded component rather than disable, so I can save my limited disk space and avoid possible conflicts. But it seems it's hard in HMPA as hmpalart.dll is responsible many tasks not limited to exploit mitigation.
     
    142395, Mar 16, 2015
    #4479
  5. XIII

    XIII Registered Member

    Joined:
    Jan 12, 2009
    Posts:
    1,383
    • Windows 7 SP1 Home Premium x64 UK, all Windows updates applied
    • Emsisoft Internet Security 9
    • Malwarebytes Anti-Malware 2
    I was running build 167 (as I have seen no newer builds).
     
    XIII, Mar 16, 2015
    #4480
  6. bjm_

    bjm_ Registered Member

    Joined:
    May 22, 2009
    Posts:
    4,458
    Location:
    .
    Question re CryptoGuard folder...
    How may I see that cyrptoguard files are being maintained / updated. The cryptoguard files Date Modified never changes. I have no way to associate a crypoguard rollback file with my files / documents. I'll update a document file expecting to see a corresponding date modified in cryptoguard files....alas no date modified change. To my understanding cryptoguard files are snapshots for rollback. How can I confirm snapshots are current ? Thanks !
     
    bjm_, Mar 16, 2015
    #4481
  7. Victek

    Victek Registered Member

    Joined:
    Nov 30, 2007
    Posts:
    6,220
    Location:
    USA
    See here:

    http://www.surfright.nl/en/cryptoguard

    If I understand correctly CryptoGuard is protecting in real time to prevent encryption, not taking snapshots for rolling back after an attack.
     
    Victek, Mar 16, 2015
    #4482
  8. Cutting_Edgetech

    Cutting_Edgetech Registered Member

    Joined:
    Mar 30, 2006
    Posts:
    5,694
    Location:
    USA
    I just did a new install of build 167 on Windows 7X64 Ultimate. I'm still having the same problem that started with build 166. I can't activate my license. It says a server error occurred. NOD 32 prompted me 3 times during the installation that a potentially unsafe application was being installed just as it did with build 166. I wonder if maybe NOD 32 is causing the installation to become corrupted. I never got any response back about this problem, or the other problems I reported last time.

    Edited: 3/16 @ 1:41 pm: I'm going to disable NOD 32 the next time I install HMPA to see if makes any difference with the license issue, and the other issues I reported.
     

    Attached Files:

    Last edited: Mar 16, 2015
    Cutting_Edgetech, Mar 16, 2015
    #4483
  9. Victek

    Victek Registered Member

    Joined:
    Nov 30, 2007
    Posts:
    6,220
    Location:
    USA
    I don't use NOD32, but perhaps you can add an exclusion for HMPA?
     
    Victek, Mar 16, 2015
    #4484
  10. Azure Phoenix

    Azure Phoenix Registered Member

    Joined:
    Nov 22, 2014
    Posts:
    1,560
    Does the license for HitmanPro also works for HitmanPro Alert?
     
    Azure Phoenix, Mar 16, 2015
    #4485
  11. Cutting_Edgetech

    Cutting_Edgetech Registered Member

    Joined:
    Mar 30, 2006
    Posts:
    5,694
    Location:
    USA
    I don't think so. It only happens during the installation. It only detects it as a potentially unsafe application. There's no conflict after that that I am aware of. Its easy to just disable NOD 32 during the installation. I could make an exception for HMPA in NOD 32 after the installation if needed.
     
    Cutting_Edgetech, Mar 16, 2015
    #4486
  12. guest

    guest Guest

    Yes.
    Only a single license is necessary for running HMP and HMPA.
     
    guest, Mar 16, 2015
    #4487
  13. lucien_phoenix

    lucien_phoenix Registered Member

    Joined:
    Oct 20, 2012
    Posts:
    133
    Location:
    Germany
    so i have come on your boot XIII here the same discribed on #4437
     
    lucien_phoenix, Mar 17, 2015
    #4488
  14. XIII

    XIII Registered Member

    Joined:
    Jan 12, 2009
    Posts:
    1,383
    Sorry, I don't understand this post. Can you please explain?
     
    XIII, Mar 17, 2015
    #4489
  15. paulderdash

    paulderdash Registered Member

    Joined:
    Dec 27, 2013
    Posts:
    4,644
    Location:
    Under a bushel ...
    I am using RC build 155 - where can I find the build 167? Is that for beta testers only?
     
    paulderdash, Mar 17, 2015
    #4490
  16. Stupendous Man

    Stupendous Man Registered Member

    Joined:
    Aug 1, 2010
    Posts:
    2,865
    Location:
    the Netherlands
    Please see Wednesday March 11th post:
     
    Stupendous Man, Mar 17, 2015
    #4491
  17. Ashanta

    Ashanta Registered Member

    Joined:
    Aug 21, 2007
    Posts:
    702
    Location:
    Europe
    Do I need to uninstall the previous beta version for this new version ?

     
    Ashanta, Mar 17, 2015
    #4492
  18. deugniet

    deugniet Registered Member

    Joined:
    Nov 25, 2013
    Posts:
    1,244
    No.
     
    deugniet, Mar 17, 2015
    #4493
  19. Victek

    Victek Registered Member

    Joined:
    Nov 30, 2007
    Posts:
    6,220
    Location:
    USA
    Victek, Mar 17, 2015
    #4494
  20. erikloman

    erikloman Developer

    Joined:
    Jun 4, 2009
    Posts:
    3,152
    Location:
    Hengelo, The Netherlands
    erikloman, Mar 17, 2015
    #4495
  21. daman1

    daman1 Registered Member

    Joined:
    Mar 27, 2009
    Posts:
    1,286
    Location:
    USA, MICHIGAN
    daman1, Mar 17, 2015
    #4496
  22. Cactus5

    Cactus5 Registered Member

    Joined:
    Jan 17, 2015
    Posts:
    28
    Location:
    Southwest USA
    @Cutting_Edgetech

    I was just using Autoruns for something else and the Virus Total scan shows this from ESET/NOD32: "a variant of Win64/NetFilter.A potentially unsafe"

    This is for the file C:\Windows\system32\drivers\hmpnet.sys

    This must be a False Positive since only 5/57 say this is something of concern. Perhaps ESET can whitelist this file after an investigation?
     
    Cactus5, Mar 17, 2015
    #4497
  23. erikloman

    erikloman Developer

    Joined:
    Jun 4, 2009
    Posts:
    3,152
    Location:
    Hengelo, The Netherlands
    We are in contact with ESET about their classification. The classification only occurs when you have enabled the PUP detection in ESET.
     
    Last edited: Mar 17, 2015
    erikloman, Mar 17, 2015
    #4498
  24. bjm_

    bjm_ Registered Member

    Joined:
    May 22, 2009
    Posts:
    4,458
    Location:
    .
    Then what are the files in the CryptoGuard folder....and how did they acquire their Date modified. My understanding is the files are snapshots for rollback. If they're are not snapshots....then what are they ?
     
    bjm_, Mar 17, 2015
    #4499
  25. erikloman

    erikloman Developer

    Joined:
    Jun 4, 2009
    Posts:
    3,152
    Location:
    Hengelo, The Netherlands
    These files are temporary and are used during rollback in case of an attack.

    PS. Congrats on your 500th post here are Wilders :thumb:
     
    erikloman, Mar 17, 2015
    #4500
Page 180 of 679
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...