HitmanPro.Alert BETA

Discussion in 'other anti-malware software' started by erikloman, May 30, 2017.

  1. shadek

    shadek Registered Member

    Joined:
    Feb 26, 2008
    Posts:
    2,538
    Location:
    Sweden
    Running CTP 4. Trying to run Media Player Classic - Home Cinema version 1.7.11. When I just run the MPC-HC.exe it's working. But whenever I try to open a video on my computer MPC-HC freezes. I have to exclude MPC-HC from exploit protection. Then it works.

    Can anyone confirm this issue?
     
  2. XhenEd

    XhenEd Registered Member

    Joined:
    Mar 31, 2014
    Posts:
    536
    Location:
    Philippines
  3. shadek

    shadek Registered Member

    Joined:
    Feb 26, 2008
    Posts:
    2,538
    Location:
    Sweden
  4. Stupendous Man

    Stupendous Man Registered Member

    Joined:
    Aug 1, 2010
    Posts:
    2,857
    Location:
    the Netherlands
    See:
     
  5. shadek

    shadek Registered Member

    Joined:
    Feb 26, 2008
    Posts:
    2,538
    Location:
    Sweden
    Jeez. Now I feel even dumber. :(
     
  6. Lockdown

    Lockdown Registered Member

    Joined:
    Oct 28, 2016
    Posts:
    772
    Location:
    Wilders Security
    Can reproduce this reliably.

    Capture.PNG
     
  7. Stupendous Man

    Stupendous Man Registered Member

    Joined:
    Aug 1, 2010
    Posts:
    2,857
    Location:
    the Netherlands
    You overlooked a couple of previous posts.
    No worries.
     
  8. Stupendous Man

    Stupendous Man Registered Member

    Joined:
    Aug 1, 2010
    Posts:
    2,857
    Location:
    the Netherlands
    Do you use OpenDNS, perhaps?
    If so, that may be the cause.
    There were several reports of OpenDNS blocking download of the HMPA installer or the HMP(A) scanner.
     
  9. Lockdown

    Lockdown Registered Member

    Joined:
    Oct 28, 2016
    Posts:
    772
    Location:
    Wilders Security
    IVPN which does utilizes customized OpenVPN client and its own DNS - but all that is disabled; running with default Windows networking during install.

    I will check the DNS - perhaps I did leave them in.

    Sure enough OpenDNS was still in there because I put it in there when I set a static IP.
     
  10. Lockdown

    Lockdown Registered Member

    Joined:
    Oct 28, 2016
    Posts:
    772
    Location:
    Wilders Security
  11. Peter2150

    Peter2150 Global Moderator

    Joined:
    Sep 20, 2003
    Posts:
    20,590
    Are you saying it failed without OpenDNS?
     
  12. Peter2150

    Peter2150 Global Moderator

    Joined:
    Sep 20, 2003
    Posts:
    20,590
    I found another big time conflict. I have been having a problem with IFW 3.07 trying to image with it's new metadata hash. Kept getting a drive read error and it turn out it was failing on a read of system32/config/SAM This is a critical file with all your account info. I switched to the new 603 beta and all was fine. Erik if you need more detail I can give them to you by PM. To test you can download a trial of Image for Windows at Terabyteunlimited.

    Pete
     
  13. Lockdown

    Lockdown Registered Member

    Joined:
    Oct 28, 2016
    Posts:
    772
    Location:
    Wilders Security
    Yes... I reset networking to automatically get DNS via ISP instead of static setting of OpenDNS.
     
  14. Stupendous Man

    Stupendous Man Registered Member

    Joined:
    Aug 1, 2010
    Posts:
    2,857
    Location:
    the Netherlands
    Could you try Google Public DNS, to see if that works?
    If so, your DNS via ISP may be problematic as well, for some reason.
    If Google Public DNS doesn't help either, something else may be blocking the scan.
     
  15. guest

    guest Guest

    Try to switch off Credential Theft Protection ("Protects your credentials against password dumping") temporarily and try it again.
     
  16. Lockdown

    Lockdown Registered Member

    Joined:
    Oct 28, 2016
    Posts:
    772
    Location:
    Wilders Security
    I already checked it. It is not DNS or any network related issue on my end.
     
  17. puff-m-d

    puff-m-d Registered Member

    Joined:
    Feb 13, 2002
    Posts:
    5,703
    Location:
    North Carolina, USA
    Hello,
    Good find @Peter2150...
    I am having the same issue but had not figured out what was causing it. I can do a full image with IFW with no issues but always get a drive read error when trying to do a differential or incremental.
    Thanks for finding and reporting this as you have saved me some time investigating what was causing this issue. I can verify that HMP.A CTP4 is causing the drive read errors with IFW when doing a differential or incremental image.
     
  18. Victek

    Victek Registered Member

    Joined:
    Nov 30, 2007
    Posts:
    6,219
    Location:
    USA
    I installed CTP4 over CTP3 and rebooted. A malware scan now completes without error :thumb: (I use Google DNS servers). Everything looks good :)
     
  19. Peter2150

    Peter2150 Global Moderator

    Joined:
    Sep 20, 2003
    Posts:
    20,590
    Hi Mood

    You hit it. I can confirm it was Credential Theft. What they need is to include that in the exclusions. I tried excluding IFW and it didn't help
     
  20. Peter2150

    Peter2150 Global Moderator

    Joined:
    Sep 20, 2003
    Posts:
    20,590
    Hi Kent

    You should see the trail of emails with Terabyte support. 4 days of hair pulling. Glad it saved you from going thru the same thing.
     
  21. Stupendous Man

    Stupendous Man Registered Member

    Joined:
    Aug 1, 2010
    Posts:
    2,857
    Location:
    the Netherlands
    Could some other additional security software be interfering with the malware scan?
    You didn't specify if and which other security software is on your test system.
     
  22. puff-m-d

    puff-m-d Registered Member

    Joined:
    Feb 13, 2002
    Posts:
    5,703
    Location:
    North Carolina, USA
    Hello @Peter2150,

    It did save me some hair (don't have much left ;)) but I still went through a few complete re-installs of IFW and many images... The bad thing is HMP.A stays quiet and does not alert to anything. If HMP.A had thrown an alert, it would have made things so much easier...
    So it seems we have two issues here:
    • Credential Theft Protection is causing errors with IFW when doing a differential or incremental image.
    • At least in this one case, HMP.A is blocking something but not alerting you to the block.
    Thanks again for saving me the money for a toupee :thumb:...
     
  23. Stupendous Man

    Stupendous Man Registered Member

    Joined:
    Aug 1, 2010
    Posts:
    2,857
    Location:
    the Netherlands
    This was not the first case of HMPA blocking something but not alerting.
    We saw the same with MPC-HC. MPC-HC's issue report showed HMPA was the cause of the issue, but HMPA didn't alert.
    There may have been more similar cases, that I don't remember.
     
  24. Lockdown

    Lockdown Registered Member

    Joined:
    Oct 28, 2016
    Posts:
    772
    Location:
    Wilders Security
    None
     
  25. Stupendous Man

    Stupendous Man Registered Member

    Joined:
    Aug 1, 2010
    Posts:
    2,857
    Location:
    the Netherlands
    Thanks, Lockdown.
    I think that shows how experiences may differ. While the HMPA scan works on other user's systems, it doesn't on yours.
    I hope Erik and Mark can think of something to get it working more reliable.
     
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.