HitmanPro.ALERT Support and Discussion Thread

Like Daxxa I also get a fail when trying to run a scan w/ HitmanPro.Alert. Every time I try to downdload a fresh copy of HMPA it says FAIL before I even try to run a scan. Are left over files the problem?? I can download Hitman Pro w/ no problems and run scans w/out a fail. Any help would be appreciated. tx
KAV,Comodo firewall and Ccleaner.

 

Make sure that your Firewall is not blocking it.

 

If you install HitmanPro first can you initiate the scan from the HMPA Scan Computer tile?

 

Had the same problem w/ G Data Internet Security the only difference HMPA would run a few weeks after a fresh install then would start to fail while trying to run scan. Seems something is corrupt somewhere. Forgot to mention I'm running Voodoo shield also. Comodo firewall is running in safe mode switching to training mode.

 

I'm running VoodooShield with HMPA without issue. Must be a conflict somewhere else.

 

+1
Same here, and VS is playing very well with HMP.A & HMP.
Running VS 3.59b & Beta HMP 3.7.20 286 & Beta 604 HMP.A

 

Me too!

 

Updating now to: hmpalert3b712 (see HMP.A thread for DL link)

 

+1 here. Never had the slightest issue with either of these running together.

 

Without HitmanPro installed, there seems to be an issue with running "Scan computer" in HitmanPro.Alert, at least for some HitmanPro.Alert users. This is a know issue for some time.
With HitmanPro installed, "Scan computer" in HitmanPro.Alert should work OK.
Have you tried as suggested, and installed HitmanPro? After the first time running HitmanPro there is the option to install it. Mind that HitmanPro is only installed after confirming to "Yes, create a copy of HitmanPro so I can regularly scan this computer".
After that, if you run "Scan computer" in HitmanPro.Alert, it should start the HitmanPro scan, as intended.

I have no knowledge of a HitmanPro.Alert and G Data Internet Security conflict.
I use HitmanPro.Alert (3.6.7.604) and G Data Internet Security (25.3.0.3) (see signature) with no known conflicts.
With HitmanPro installed, "Scan computer" in HitmanPro.Alert works fine. I don't know if it would work if HitmanPro was not installed.

 

Thank you all for your input,I did install Hitman Pro w/ HMPA now all seems to work fine. Have a great Sunday.

 

Great! Thanks for reporting.
Nevertheless, I hope Erik and Mark and the team can fix whatever is causing "Scan computer" to fail in HMPA if HMP is not installed.

 

I'm sure they have lost some business w/ HMPA due to people not knowing they may have to download both programs to get HMPA to scan.

 

Not sure what is going on here but the latest Beta avaialbe does not appear to have this issue...base don the very recent test I just ran.

Not sure if that helps or not?

Baldrick

 

If I uninstall HitmanPro and click on "Scan computer" in HMPA, it then shows "Downloading", and then the HitmanPro scan runs. No errors here.

If I recall correctly, I did see this error once in the past, but it was a firewall rule that was blocking the automatic download. Corrected that and no problems since. I do prefer to keep it locally installed though ...

 

A quick work around that I have found to work is to open Hitman Pro Alert from the start menu icon. But you run as administrator. I cannot confirm this but I think somehow the elevated privileges allow HMPA to download HitMan Pro in the background. I run into this error on my desktop which I only have running as a limited user.

I am running Kaspersky Anti Virus + Windows 10 Pro on my desktop.

 

"Cyber security pioneer Sophos Group enjoys record growth rising 33% since WannaCry ransomware attack in May..."

http://www.thisismoney.co.uk/money/...ORT-Sophos-Group-shares-set-fresh-record.html

Congratz @erikloman @markloman

 

+1

 

Hi all,
Does anyone know if its possible to get HitmanPro to 'verbatim' log or output all activity for debugging?
Does anyone know how you can let HitmanPro know that it is doing something wrong? Maybe give it a whitelist?

We are running into some issues with HitmanPro and hoping that we might be able to get some success with the developers/people here.
Our site is running Sophos Cloud with InterceptX (re-branded HitmanPro) - for the most part it is working well......but it is unfortunately getting in the way of some legitimate activities.
We have had a case with Sophos on these issues for over 3 months now but Sophos support has become so terribly hopeless in recent years, i have lost all faith in them and theri ability to resolve these issues.....which has eventually lead me here....to a resource/skill base that may be able to assist.
The reason why we have linked our issues to the HitmanPro component of Sophos is because when we disable ONLY the HitmanPro service, the problems vanish.

The main issue we are seeing HitmanPro cause is with Word 2010 (on Win10) and the process of saving word files to our Document management system using the Word Plugin for our Document Management system - upon clicking the SAVE button on the word plugin, Word completely locks up.....you cannot even end task word at this point (you get an Access Denied error even though full admin and can end any other task) - you have to reboot the computer to get word working agian OR the system will completely lockup eventually if you dont reboot soon enough after word is locked.
Of course, none of this happens when the HitmanPro service is Disabled.

I have seen that there are other reports of hitmanPro causing application/system lock ups like this......but cannot really find any solution for any of them....mostly i just find that "HitmanPro new release fixes that issue".

The worst thing is that HitmanPro does not seem to do any kind of logging/reporting at all.....so we cant actually see WHAT it is upset about, what it is stopping or why its making a decision to get in the way.......Does anyone know if its possible to get HitmanPro to 'verbatim' log or output all activity for debugging?
Does anyone know how you can let HitmanPro know that it is doing something wrong? Maybe give it a whitelist?

 

Sorry to hear you're having issues. Not sure what you are referring to as the HitmanPro service? HitmanPro is a separate executable on-demand malware scanner. HitmanPro.Alert service, runs as a real-time service from C:\Program Files (x86)\HitmanPro.Alert\hmpalert.exe in the consumer version.

The HitmanPro scanner "C:\Program Files\HitmanPro\HitmanPro.exe" places a scan log in C:\ProgramData\HitmanPro\Logs.

HitmanPro.Alert sends any exception reports to the Windows Event Viewer, event ID 911, Mitigation.

HitmanPro.Alert is not signature based, or an anti-executable, so no blacklisting/whitelisting available that I know of.

I did discover that rapidly saving multiple documents in LibreOffice caused the CrypoGuard to kick in and locked up the docs. The workaround was to turn off the Cryptoguard protection while saving these files.

 

Thanks for replying!
When you install Sophos InterceptX (Hitman) it installs an always on system service - this is what i am talking about when i say that if we disable this service (then reboot the system) - our issues go away.


Thanks for pointing out that log location - Sophos have never asked about that or even looked at that. Ive just had a look in there now (while triggering the issue) and i can see that the word process is logged in there.....but nothing really else in the way of showing what hitman is actually doing....below is the log....doesnt really tell anything?



With the event log - i cannot find any EventID 911 in there and the only 'hitmanpro' events in the event log i can find are related to "hitman pro service started or stopped" - no clues there, but would be excellent if Hitman mitigation did report to the event log (i checked all event log containers even App and Service containers).
Is there something i need to do to get hitman to report activity to the event log - or that should just happen?

 

Your questions need to be addressed to the Sophos devs. As far as I can see here, HitmanPro.Alert is working well as designed in the civilian version, and reporting mitigation logs that can easily be interpreted, or forwarded to support for resolution.

 

Unfortunately Sophos have been working on this case and this exact issue for over 3 months now......thats MONTHS, not days or even weeks. They are getting nowhere - my belief is that they just dont know enough about Hitman, how it works........hence me landing here - hoping the long term Hitman users and the 'real' Hitman Devs might be able to help with working out how to get Hitman to report on what its doing.....and then possibly figure out a solution.

All these questions i have posted here (and many more) have already been addressed to Sophos Devs..........but they have not/cannot answer any of them. The case is still active with them....but i am just reaching out now to anywhere/everywhere i can to make progress on this.

Maybe someone/dev will see this and be able to reveal a way to increase hitman logging/reporting for testing/debugging or any kind of solution or way of letting Hitman know that it is doing something wrong.

 

As @Tinstaafl pointed out, the service you have highlighted belongs to the exploit mitigation HitmanPro.Alert program (used in business version Intercept X), not to be confused with on demand scanner HitmanPro, which is invoked by HitmanPro.Alert (or can be installed and run standalone). Maybe that caused a disconnect with Sophos support, though they should know this, of course.
Disabling the service would effectively disable HitmanPro.Alert and its protections.

He is right, the devs would need to investigate your particular issue.
Maybe you can try direct messaging @erikloman or @markloman?

 

That issue was fixed with HMPA 3.6.5.592.
I tested again with 3.6.6.593.