Hitman Pro Support and Discussion Thread

Yes, detection is reduced because in that mode HitmanPro cannot find tough bootkits and rootkit.

Looking forward to see if the problem is resolved switching to Compatible Disk Access.

Can you also run HimanPro with AX64 enabled, using the following command line:

HitmanPro_x64.exe /console /miniport

And past the output in a PM or post? Much appreciated

 

Hello erik,

I was able to run scans after changing to Compatible Mode.

Here is the info you requested:

Driver started
<Primary>
DriverObject: FFFFFA80079CFE60
DriverName : \Driver\nvstor64
DriverPath : \SystemRoot\system32\DRIVERS\nvstor64.sys
StartIo : 0000000000000000 +0
IRP_MJ_SCSI : FFFFF88001523DA0 \SystemRoot\system32\DRIVERS\storport.sys+11680

Primary
DriverObject . . . : FFFFFA80079CFE60
DriverName . . . . : \Driver\nvstor64
DriverPath . . . . : \SystemRoot\system32\DRIVERS\nvstor64.sys
StartIo . . . . . : 0000000000000000 +0
IRP_MJ_SCSI . . . : FFFFF88001523DA0 \SystemRoot\system32\DRIVERS\storport.sys+11680

 

Hello erik,

I know the two modes are the Direct Disk Mode and the Compatible Mode. I do not know if this info will help or not, but I use Malwarebytes Anti-Rootkit to scan occasionally. It uses a "direct disk" mode also to scan but I have no problems completing those scans.

 

On two Win7 (x64) machines with no problems here.

 

No problems with 197 or 198 here (W7 SP1 x86).

 

Still unable to auto-update. It just hangs at about 1/3rd...

 

What Motherboard brand and model are you using? Because the problem might be related to the nvstor64.sys and the way HitmanPro is talking to it.

Maybe you can send the nvstory64.sys from your drivers directory to erik@surfright.com.

 

Are you using firewall software? Maybe other software is interfering with the download? Maybe setting Proxy settings under Settings -> Proxy to No Proxy?

 

Hello erik,

Email sent. Thanks...

 

Hi all

HitmanPro 3.7.5 Build 199

FIXED: Suspicious classified items set to Quarantine were not removed after pressing Next button.

http://www.surfright.nl/en/whatsnew

http://www.surfright.nl/en/downloads/

 

Hi Erik

Can you Whitelist the Files please

Here is the Log for you

Code:

HitmanPro 3.7.5.199
www.hitmanpro.com

   Computer name . . . . : ALEXANDERROB-PC
   Windows . . . . . . . : 6.0.2.6002.X86/2
   User name . . . . . . : AlexanderRob-PC\Alexander Robrecht
   UAC . . . . . . . . . : Enabled
   License . . . . . . . : Free

   Scan date . . . . . . : 2013-05-24 19:24:05
   Scan mode . . . . . . : EWS
   Scan duration . . . . : 8m 42s
   Disk access mode  . . : Direct disk access (SRB)
   Cloud . . . . . . . . : Internet
   Reboot  . . . . . . . : No

   Threats . . . . . . . : 0
   Traces  . . . . . . . : 120

   Objects scanned . . . : 3.976.845
   Files scanned . . . . : 66.521
   Remnants scanned  . . : 2.352.564 files / 1.557.760 keys

Suspicious files ____________________________________________________________

   C:\Users\Alexander Robrecht\AppData\Local\Temp\{36D875A0-5FCB-42D4-A83A-526C69A82A7C}\ISSetup.dll
      Size . . . . . . . : 1.939.647 bytes
      Age  . . . . . . . : 189.1 days (2012-11-16 17:08:20)
      Entropy  . . . . . : 7.9
      SHA-256  . . . . . : 9F7CE0F27ADE9FD24B1A3FB944667BAFAD5E98B0CB3F19F0012AD6B653DF661E
      Fuzzy  . . . . . . : 22.0
         Entropy (or randomness) indicates the program is encrypted, compressed or obfuscated. This is not typical for most programs.
         The Entry Point of this file lies in a resource section. This is an indication of malware infection.
         The .rsrc (resources) section in this program is set to executable. This is an indication of malware infection.
         Authors name is missing in version info. This is not common to most programs.
         Version control is missing. This file is probably created by an individual. This is not typical for most programs.
         Program contains PE structure anomalies. This is not typical for most programs.
      Forensic Cluster
         -35.3s C:\Users\Alexander Robrecht\AppData\Local\Temp\{36D875A0-5FCB-42D4-A83A-526C69A82A7C}\
         -35.2s C:\Users\Alexander Robrecht\AppData\Local\Temp\{36D875A0-5FCB-42D4-A83A-526C69A82A7C}\_ISMSIDEL.INI
         -35.2s C:\Users\Alexander Robrecht\AppData\Local\Temp\{36D875A0-5FCB-42D4-A83A-526C69A82A7C}\Setup.INI
         -35.1s C:\Users\Alexander Robrecht\AppData\Local\Temp\{36D875A0-5FCB-42D4-A83A-526C69A82A7C}\0x0409.ini
         -34.9s C:\Users\Alexander Robrecht\AppData\Local\Temp\{36D875A0-5FCB-42D4-A83A-526C69A82A7C}\0x0412.ini
         -34.4s C:\Users\Alexander Robrecht\AppData\Local\Temp\{36D875A0-5FCB-42D4-A83A-526C69A82A7C}\1033.MST
         -5.9s C:\Users\Alexander Robrecht\AppData\Local\Temp\{36D875A0-5FCB-42D4-A83A-526C69A82A7C}\Samsung Kies.msi
          0.0s C:\Users\Alexander Robrecht\AppData\Local\Temp\{36D875A0-5FCB-42D4-A83A-526C69A82A7C}\ISSetup.dll
          6.4s C:\Users\Alexander Robrecht\AppData\Local\Temp\{79B9D176-F814-4B8D-AF11-E7DB014E874F}\
          7.8s C:\Users\Alexander Robrecht\AppData\Local\Temp\{79B9D176-F814-4B8D-AF11-E7DB014E874F}\setup.inx
          7.9s C:\Users\Alexander Robrecht\AppData\Local\Temp\{79B9D176-F814-4B8D-AF11-E7DB014E874F}\ISRT.dll
          8.2s C:\Users\Alexander Robrecht\AppData\Local\Temp\{79B9D176-F814-4B8D-AF11-E7DB014E874F}\setup.exe
          8.5s C:\Users\Alexander Robrecht\AppData\Local\Temp\{79B9D176-F814-4B8D-AF11-E7DB014E874F}\_isres_0x0409.dll
          9.1s C:\Users\Alexander Robrecht\AppData\Local\Temp\{79B9D176-F814-4B8D-AF11-E7DB014E874F}\String1033.txt
         12.0s C:\Users\Alexander Robrecht\AppData\Local\Temp\{79B9D176-F814-4B8D-AF11-E7DB014E874F}\EULA_1054.txt
         12.0s C:\Users\Alexander Robrecht\AppData\Local\Temp\{79B9D176-F814-4B8D-AF11-E7DB014E874F}\EULA_1055.txt
         12.0s C:\Users\Alexander Robrecht\AppData\Local\Temp\{79B9D176-F814-4B8D-AF11-E7DB014E874F}\EULA_1057.txt
         12.1s C:\Users\Alexander Robrecht\AppData\Local\Temp\{79B9D176-F814-4B8D-AF11-E7DB014E874F}\MSSetupAddinDllForVista.dll
         12.1s C:\Users\Alexander Robrecht\AppData\Local\Temp\{79B9D176-F814-4B8D-AF11-E7DB014E874F}\MSSetupAddinDll.dll
         12.2s C:\Users\Alexander Robrecht\AppData\Local\Temp\{79B9D176-F814-4B8D-AF11-E7DB014E874F}\BrowseFolderDll.dll
         12.2s C:\Users\Alexander Robrecht\AppData\Local\Temp\{79B9D176-F814-4B8D-AF11-E7DB014E874F}\EULA_1040.txt
         12.2s C:\Users\Alexander Robrecht\AppData\Local\Temp\{79B9D176-F814-4B8D-AF11-E7DB014E874F}\EULA_1053.txt
         12.2s C:\Users\Alexander Robrecht\AppData\Local\Temp\{79B9D176-F814-4B8D-AF11-E7DB014E874F}\install_01.bmp
         12.2s C:\Users\Alexander Robrecht\AppData\Local\Temp\{79B9D176-F814-4B8D-AF11-E7DB014E874F}\WriteDescExecuteFileName.exe
         12.3s C:\Users\Alexander Robrecht\AppData\Local\Temp\{79B9D176-F814-4B8D-AF11-E7DB014E874F}\Execute2App.exe
         12.3s C:\Users\Alexander Robrecht\AppData\Local\Temp\{79B9D176-F814-4B8D-AF11-E7DB014E874F}\KiesProgressDialog.dll
         12.7s C:\Users\Alexander Robrecht\AppData\Local\Temp\{79B9D176-F814-4B8D-AF11-E7DB014E874F}\Kies2RemoveAll.exe
         12.8s C:\Users\Alexander Robrecht\AppData\Local\Temp\{79B9D176-F814-4B8D-AF11-E7DB014E874F}\Microsoft.VC90.CRT.manifest
         13.1s C:\Users\Alexander Robrecht\AppData\Local\Temp\{79B9D176-F814-4B8D-AF11-E7DB014E874F}\msvcr90.dll
         13.2s C:\Users\Alexander Robrecht\AppData\Local\Temp\{79B9D176-F814-4B8D-AF11-E7DB014E874F}\EULA_1041.txt
         13.2s C:\Users\Alexander Robrecht\AppData\Local\Temp\{79B9D176-F814-4B8D-AF11-E7DB014E874F}\EULA_1038.txt
         13.2s C:\Users\Alexander Robrecht\AppData\Local\Temp\{79B9D176-F814-4B8D-AF11-E7DB014E874F}\EULA_1037.txt
         13.2s C:\Users\Alexander Robrecht\AppData\Local\Temp\{79B9D176-F814-4B8D-AF11-E7DB014E874F}\EULA_1036.txt
         13.3s C:\Users\Alexander Robrecht\AppData\Local\Temp\{79B9D176-F814-4B8D-AF11-E7DB014E874F}\EULA_1035.txt
         13.3s C:\Users\Alexander Robrecht\AppData\Local\Temp\{79B9D176-F814-4B8D-AF11-E7DB014E874F}\EULA_1033.txt
         13.3s C:\Users\Alexander Robrecht\AppData\Local\Temp\{79B9D176-F814-4B8D-AF11-E7DB014E874F}\EULA_1032.txt
         13.3s C:\Users\Alexander Robrecht\AppData\Local\Temp\{79B9D176-F814-4B8D-AF11-E7DB014E874F}\EULA_1031.txt
         13.3s C:\Users\Alexander Robrecht\AppData\Local\Temp\{79B9D176-F814-4B8D-AF11-E7DB014E874F}\EULA_1030.txt
         13.3s C:\Users\Alexander Robrecht\AppData\Local\Temp\{79B9D176-F814-4B8D-AF11-E7DB014E874F}\EULA_1042.txt
         13.5s C:\Users\Alexander Robrecht\AppData\Local\Temp\{79B9D176-F814-4B8D-AF11-E7DB014E874F}\EULA_1025.txt
         13.5s C:\Users\Alexander Robrecht\AppData\Local\Temp\{79B9D176-F814-4B8D-AF11-E7DB014E874F}\EULA_1026.txt
         13.5s C:\Users\Alexander Robrecht\AppData\Local\Temp\{79B9D176-F814-4B8D-AF11-E7DB014E874F}\EULA_1028.txt
         13.5s C:\Users\Alexander Robrecht\AppData\Local\Temp\{79B9D176-F814-4B8D-AF11-E7DB014E874F}\EULA_1029.txt
         13.5s C:\Users\Alexander Robrecht\AppData\Local\Temp\{79B9D176-F814-4B8D-AF11-E7DB014E874F}\EULA_1043.txt
         13.5s C:\Users\Alexander Robrecht\AppData\Local\Temp\{79B9D176-F814-4B8D-AF11-E7DB014E874F}\EULA_1044.txt
         13.5s C:\Users\Alexander Robrecht\AppData\Local\Temp\{79B9D176-F814-4B8D-AF11-E7DB014E874F}\EULA_1045.txt
         13.5s C:\Users\Alexander Robrecht\AppData\Local\Temp\{79B9D176-F814-4B8D-AF11-E7DB014E874F}\EULA_1046.txt
         13.5s C:\Users\Alexander Robrecht\AppData\Local\Temp\{79B9D176-F814-4B8D-AF11-E7DB014E874F}\EULA_1048.txt
         13.6s C:\Users\Alexander Robrecht\AppData\Local\Temp\{79B9D176-F814-4B8D-AF11-E7DB014E874F}\EULA_1049.txt
         13.6s C:\Users\Alexander Robrecht\AppData\Local\Temp\{79B9D176-F814-4B8D-AF11-E7DB014E874F}\EULA_1050.txt
         13.6s C:\Users\Alexander Robrecht\AppData\Local\Temp\{79B9D176-F814-4B8D-AF11-E7DB014E874F}\EULA_1051.txt
         13.6s C:\Users\Alexander Robrecht\AppData\Local\Temp\{79B9D176-F814-4B8D-AF11-E7DB014E874F}\EULA_1058.txt
         13.6s C:\Users\Alexander Robrecht\AppData\Local\Temp\{79B9D176-F814-4B8D-AF11-E7DB014E874F}\EULA_1061.txt
         13.9s C:\Users\Alexander Robrecht\AppData\Local\Temp\{79B9D176-F814-4B8D-AF11-E7DB014E874F}\EULA_1062.txt
         13.9s C:\Users\Alexander Robrecht\AppData\Local\Temp\{79B9D176-F814-4B8D-AF11-E7DB014E874F}\EULA_1063.txt
         13.9s C:\Users\Alexander Robrecht\AppData\Local\Temp\{79B9D176-F814-4B8D-AF11-E7DB014E874F}\EULA_1066.txt
         13.9s C:\Users\Alexander Robrecht\AppData\Local\Temp\{79B9D176-F814-4B8D-AF11-E7DB014E874F}\EULA_1081.txt
         13.9s C:\Users\Alexander Robrecht\AppData\Local\Temp\{79B9D176-F814-4B8D-AF11-E7DB014E874F}\EULA_1086.txt
         13.9s C:\Users\Alexander Robrecht\AppData\Local\Temp\{79B9D176-F814-4B8D-AF11-E7DB014E874F}\EULA_2052.txt
         13.9s C:\Users\Alexander Robrecht\AppData\Local\Temp\{79B9D176-F814-4B8D-AF11-E7DB014E874F}\EULA_2057.txt
         14.0s C:\Users\Alexander Robrecht\AppData\Local\Temp\{79B9D176-F814-4B8D-AF11-E7DB014E874F}\EULA_2058.txt
         14.0s C:\Users\Alexander Robrecht\AppData\Local\Temp\{79B9D176-F814-4B8D-AF11-E7DB014E874F}\EULA_2070.txt
         14.0s C:\Users\Alexander Robrecht\AppData\Local\Temp\{79B9D176-F814-4B8D-AF11-E7DB014E874F}\EULA_3076.txt
         14.0s C:\Users\Alexander Robrecht\AppData\Local\Temp\{79B9D176-F814-4B8D-AF11-E7DB014E874F}\EULA_3082.txt
         14.0s C:\Users\Alexander Robrecht\AppData\Local\Temp\{79B9D176-F814-4B8D-AF11-E7DB014E874F}\EULA_3084.txt
         14.0s C:\Users\Alexander Robrecht\AppData\Local\Temp\{79B9D176-F814-4B8D-AF11-E7DB014E874F}\msvcp90.dll
         16.3s C:\Users\Alexander Robrecht\AppData\Local\Temp\7bb4.rra


Early Warning Scoring _______________________________________________________

   C:\Windows\system32\ie4uinit.exe
      Size . . . . . . . : 174.080 bytes
      Age  . . . . . . . : 10.0 days (2013-05-14 19:19:44)
      Entropy  . . . . . : 7.3
      SHA-256  . . . . . : F755180707084BB7BD7615162506625F7CB7E438B780A22CCE40DB75E8EF3768
      Product  . . . . . : Windows® Internet Explorer
      Publisher  . . . . : Microsoft Corporation
      Description  . . . : IE Per-User Initialization Utility
      Version  . . . . . : 8.00.6001.19418
      Copyright  . . . . : © Microsoft Corporation. All rights reserved.
      Fuzzy  . . . . . . : 10.0
         Entropy (or randomness) indicates the program is encrypted, compressed or obfuscated. This is not typical for most programs.
         Program starts automatically without user intervention.
         The file is located in a folder that contains core operating system files from Windows. This is not typical for most programs and is only common to system tools, drivers and hacking utilities.
         Time indicates that the file appeared recently on this computer.
         The file is protected by Windows File Protection (WFP). This is typical for critical Windows system files.
      Startup
         HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\>{26923b43-4d38-484f-9b9e-de460746276c}\
         HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}\

   C:\Windows\System32\ieframe.dll
      Size . . . . . . . : 11.111.424 bytes
      Age  . . . . . . . : 10.0 days (2013-05-14 19:19:46)
      Entropy  . . . . . : 6.4
      SHA-256  . . . . . : 841A2DA1F516E4F3D20539A7632E09810BB9F3C7F60DEAED77A6C486B402FF1D
      Product  . . . . . : Windows® Internet Explorer
      Publisher  . . . . : Microsoft Corporation
      Description  . . . : Internet Explorer
      Version  . . . . . : 8.00.6001.19418
      Copyright  . . . . : © Microsoft Corporation. All rights reserved.
      Fuzzy  . . . . . . : 7.0
         Program starts automatically without user intervention.
         The file is in use by one or more active processes.
         The file is located in a folder that contains core operating system files from Windows. This is not typical for most programs and is only common to system tools, drivers and hacking utilities.
         Time indicates that the file appeared recently on this computer.
         The file is protected by Windows File Protection (WFP). This is typical for critical Windows system files.
      Startup
         HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\UrlSearchHooks\{CFBFAE00-17A6-11D0-99CB-00C04FD64497}
         HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\UrlSearchHooks\{CFBFAE00-17A6-11D0-99CB-00C04FD64497}
         HKU\S-1-5-21-911542882-2029379874-2294310465-1000\SOFTWARE\Microsoft\Internet Explorer\UrlSearchHooks\{CFBFAE00-17A6-11D0-99CB-00C04FD64497}
      References
         HKLM\SOFTWARE\Classes\CLSID\{CFBFAE00-17A6-11D0-99CB-00C04FD64497}\
         HKU\S-1-5-21-911542882-2029379874-2294310465-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{CFBFAE00-17A6-11D0-99CB-00C04FD64497}\

 

Only using Windows firewall. Tried setting Proxy to No Proxy, but no luck.

 

This is exactly what just happened to me. I closed and reopened HMP and it would not even connect the second time. I've never had any trouble previously.

Is there a way to run HMP without the update? It is excellent for clearing cookies.

ETA: Fourth or fifth attempt completed the update. Appears to be scanning properly now. I do have internet connectivity problems at this time of the day - between 5-6 p.m. (end of workday?), so perhaps that is why the automatic update didn't work previously.

 

Build 199
Run HitmanPro.exe /debug:full
Where is this dump ?
HP to crash closes and that's it.
Sorry my bad English

 

I'm using AX64 and had the same problem, HitmanPro stuck and hard to start.

 

it seems that this HTP 199 Build has some Problems on Windows 7 64Bit Machines
i have allready upgrade to the 199 Build and on my Windows 7 Ultimate 32 Bit Sp1
Machine and HtP Build 199 runs without any Problems.




Lucien

 

No problems on Vista 32 bit pack 2 and windows 7 64 bit pack 1

 

What kind of problems on 64-bit?

 

No problems here with Win7 x64 with all current MS updates applied, except the "platform update" KB2670838, and IE 10. Using Windows firewall with WFC interface. HMP paid if that makes any difference.

 

For me too no problem with Windows 7 64 bit.
There's nobody that obtain the crash of HP with Windows XP ?

 

Win 7 64 bit user here- also no problems with build 199.

 

All fine here running 199 on XP Pro and having AX64 Time Machine installed.

 

Decided to run Hitman, after downloading software which forced installed ASK.com and Babylon toolbars.

It's been 1h 3m 53s (per HitmanPro) and SLOWLY searching at 98% under the directory "C:\Windows\SysWOW64\", system is hanging and unable to navigate. When running Hitman with the system fully loaded I noticed (ProcessExplorer) displaying HIGH system interrupts, hard shutdown then booted into Safe mode, but unsure if it's the same issue here. HitmanPro has been in the SysWOW directory 15min after it started, it is scanning but with horrible system hangs.

Guess I'll just let it continue since I have my mac to work with.

 

Press CTRL + SHIFT + left-click on Hitman Pro start menu icon. It will brute force close all programs except HMP and Windows components. Then do a scan. See if that solves the problem; it should do the trick.

 

Unfortunately no improvement. Scanning (safe mode) was very smooth, as before, up until 2m 59s (58%) directory C:\Windows\System32, system hangs again.

I'm not too worried about it, I'll let it run, but could it be an issue with the build? I'll assume it's related to system interrupts as it was when the system is fully booted.