HitmanPro.Alert 2.0 Reviewed

Addendum:

I have subsequently installed this program on Win 7  systems (Home Premium, and Professional) with no problems that I can discern.

Since I'm probably using a few different security tools from Joe (I suspect KeySrambler, EMET, and/or MBAE), I decided to test out HitmanPro.Alert as well, on Win7x64 Pro SP1:

As Joe noted, it installed:

HitmanPro.Alert Service:   HITMANPRO.ALE (Automatic startup) - "Web browser intrusion detection, real-time and forensics-based, watching for banking trojans and Man-in-the-Browser attacks".

and the Program file:  HMPAlert.exe (x86) (which runs as a system-invoked task in the background)

I found that it also installed:

2 DLL files:  HMPAlert.dll (one under System32, another under SysWOW64)

1 SYS file:  HMPAlert.sys (under System32\drivers)

====================

The first conflict --- MalwareBytes AntiEXPLOIT [MBAE] was not happy:   hmpalert_update.exe has been blocked.   I'm not sure if it's only an "update attempt" that was blocked... because the HMPAlert program apparently remained running in the Task Manager.

====================

Upon opening my browsers (IE & FF), I temporarily get the green (=safe) message in the upper-right corner that "Hitman Pro is watching your browser.  Currently no intruders detected."   And that was the extent of what I saw.

I accessed several important financial/confidential sites, including credit cards, brokerage & mutual funds, and medical related.   Didn't notice anything in my limited testing.

Hopefully, the lack of any intruder warning is an (implied) indication that my browser and these sites were all safe.   On the other hand --- especially not knowing how much (if any) of HitmanPro.Alert's action may have been blocked by MBAE --- it would be more reassuring to actually see some positive indication of safety at these sites [e.g., the way WOT reacts on a site-by-site basis].

I'm going to reboot and try things again.  

=====================

After rebooting, about the only thing I can add is that it seems that the block message from MBAE appears only once per session... the first time I open IE (or FF) after logging on... but thereafter, I don't get additional blocking messages from it.

Since HitManPro.alert runs entirely in the background, I guess it doesn't hurt to keep around (at least, for a while), to see if I notice anything else.   Whether it offers me any additional protection (over the likes of KeyScambler and MBAE) is a matter for debate that I cannot answer.

Thanks ky.

Indeed, I do not use KeyScrambler, EMET, or MBAE.

It is always difficult to know how much security is sufficient, or when one has too much. And too often, one never knows if a program is delivering what it claims to do. My criteria for keeping any security program has always been "does it give me any grief?", "does it duplicate any function I already have", and "does it come from a reputable source?".

For this particular program, I would have to answer No/?/Yes.

FWIW, I'm now using HitmanPro.Alert on my main PC.   I plan to continue to do so unless/until I note some problems... which, aside from the minor conflict with MBAE(*), have not impacted me.

(*) It seems that HitmanPro.Alert's updater *IS* functioning, despite it allegedly being intercepted/blocked [at times] by MBAE.

Well I'm back to report that I've had to remove HMP.Alert from both of my Win7(x64 Pro SP1) systems :emotion-6:

I caN'T say that the problem was intrinsic to HMP.A itself... it may in fact be a conflict between HMP.A and [one or more of] my existing security programs.   Suffice it to say that IE10 was crashing regularly on both systems after I introduced HMP.A.   Checking the event viewer, the fault would be placed on various .dll files:  nt.dll , mshtml.dll , msvcr100d.dll , yt.dll (as opposed to directly blaming HMP.A).   I guess one might still argue it was "just a coincidence".   But I think it unlikely that I would experience all these crashes on two separate systems after installing HMP.A --- not before --- and so far, in the short time since removing it, I haven't experienced another IE crash.

[I'm not about to try to uninstall my other, nicely-cooperating security programs, one-by-one, to see if I can pinpoint the exact cause of the conflict.   I will live with what I have/know.]

In addition, on one of the two systems, HMP.A did NOT uninstall "cleanly" --- it (definitely) generated a BSOD when I tried to reboot.

So for me, this experiment is over.

Sorry to hear that, ky. I would do the same, under the circumstances.

HMP.Alert continues to work well on all my systems after about 3 weeks, including Win 7x64 sp1 (Home premium). But, as noted, we use somewhat different security programs.

Unfortunately there is no support forum for HMP products, in which to report conflicts or explore solutions.

Even if HMP.A had an active support site, I think it would be rather difficult to diagnose the source of my conflict, given all the various layers of protection I have installed.   And as noted above, I wouldn't be willing to disable/uninstall items one at a time to test things out.

[When I've had issues with MBAE, they keep asking me to uninstall EMET, to see if that's the source of conflict.   I reluctantly, but truthfully, tell them that I don't wish to do so.]

I think that the idea behind HMP.A --- to help protect people at banking and other sensitive/transaction sites --- is definitely worth pursuing.

I'm testing HitmanPro.Alert again.   The concept --- protection against financial malware --- is certainly worth reconsidering.

One of the problems I (and others) had with HMP.A is that MBAE (Anti-EXPLOIT) would block HMP's updater.   I read today where some people assert this is no longer happening... so I figured that was a reason for me to test it again.

Interestingly, MBAE says that it has NOT yet addressed the issue.   So perhaps the lack of blocking --- at least, so far --- is an indication of a change implemented by HMP.A itself???   We can certainly hope so.  

As for my other issue, of IE crashing, I've had none so far.   I've used it all day on one system... and have just installed it on a second.   We'll have to give it a few days in order to make a legitimate conclusion.

I am going to give it a go later today on my Vista system and see how it works. Will uninstall KeyScrambler before I install this.

Dale,

You can certainly remove KeyScrambler if you wish... but I don't believe there is any conflict there.   I have KeyScrambler running on my systems, along with HitManPro.Alert, MBAM/MBAE, and everything else in my signature.   The conflict, if any, is [or was] most-likely with MBAE.

Just FYI, there is a long support/discussion thread for HitmanPro.Alert over at Wilders:

http://www.wilderssecurity.com/showthread.php?t=324841&page=32

The developer is reporting that a new version 3 will be released shortly. The current version is 2.0.10.45.

I've again had to remove HitmanPro.Alert from 2 (of 3) systems:

On my XP system, HMP.A was apparently triggering MBAE to [sometimes, but not always] block IE and FF from even opening.   Interestingly, this did not happen on my Win7 systems... IE & FF both opened fine, offering protection using both HMP.A and MBAE.  (I also encountered a BSOD on my XP system... for the first time in years... which allegedly placed the blame on KeyScrambler... hmm...)

As for my main Win7 system, HMP.A seemed to significantly slow-down the boot-up.   In fact, twice the boot-up was so slow... perhaps it even froze... that I had no choice but to hard-shut-down the system to abort the failed boot:emotion-6: .  I still have HMP.A on a second Win7 system, and will pay closer attention to what's happening there.

In fairness to HitmanPro.Alert --- the concept of which I really like --- I caN'T assert that my problems were intrinsic to HMP.A itself... indeed, it's more likely a conflict between HMP.A and [one or more of] my existing security programs.  Clearly, given all the security I have loaded (per my signature), it's difficult for me to place definitive blame.   For example, while the obvious issue on my XP system was HMP.A vs. MBAE, I have to wonder whether my recent update to avast 2014 there might have been a catalyst.  [If so, this would explain why I didn't encounter the same problem on my primary Win7 system which is still running Avast8, nor on a second Win7 system which is using Panda Cloud.   The difference in anti-virus programs could likewise explain why I had bootup issues on one Win7 system but not on the other.]   For Joe (or anyone else) who is using HMP.A without issue, I wish you continued success.

"...was your slow boot on the same hardware that we both have in common?"

Yes... (answered more explicitly via e-mail).   And the slowdown was extreme.

As for my main Win7 system, HMP.A seemed to significantly slow-down the boot-up.   In fact, twice the boot-up was so slow...