[SOLVED] Conflict with HMP.Alert

[MrCharlie]

I installed the new version of MBAE and now can't access the internet. Re-installed several times..same results.

This is on XP pro using IE and Chrome. Previous version worked fine.

If I disable MBAE, problem goes away.

 

(also using Open DNS)

 

Thanks...MrC

[pbust]

Do you have EMET installed by any chance?

 

Also please post a DDS log and the logs from MBAE.

[MrCharlie]

Correction: not using Open DNS on this computer

 

---------------------------------

 

Do you have EMET installed by any chance?

No

 

------------------------------------

 

DDS (Ver_2012-11-20.01) - FAT32_x86
Internet Explorer: 8.0.6001.18702
Run by Charlie at 19:52:03 on 2014-06-13
.
============== Running Processes ================
.
C:\Program Files\HitmanPro.Alert\hmpalert.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Malwarebytes Anti-Exploit\mbae.exe
C:\Program Files\tinySpell\tinyspell.exe
C:\WINDOWS\system32\devldr32.exe
C:\Program Files\Foxit Software\Foxit Reader\Foxit Cloud\FCUpdateService.exe
C:\Program Files\Malwarebytes Anti-Exploit\mbae-svc.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\Program Files\Malwarebytes Anti-Malware\mbamscheduler.exe
C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe
C:\Program Files\RealNetworks\RealDownloader\rndlresolversvc.exe
C:\Program Files\Malwarebytes Anti-Malware\mbam.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Windows NT\Accessories\wordpad.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k NetworkService
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\WINDOWS\system32\svchost.exe -k imgsvc
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.google.com/
BHO: RealNetworks Download and Record Plugin for Internet Explorer: {3049C3E9-B461-4BC5-8870-4C09146192CA} - c:\documents and settings\all users\application data\realnetworks\realdownloader\browserplugins\ie\rndlbrowserrecordplugin.dll
uRun: [tinySpell] c:\program files\tinyspell\tinyspell.exe
mRun: [Malwarebytes Anti-Exploit] c:\program files\malwarebytes anti-exploit\mbae.exe
StartupFolder: c:\docume~1\charlie\startm~1\programs\startup\erunta~1.lnk - c:\program files\erunt\AUTOBACK.EXE
uPolicies-Explorer: NoDriveTypeAutoRun = dword:145
mPolicies-Windows\System: Allow-LogonScript-NetbiosDisabled = dword:1
mPolicies-Explorer: NoDriveTypeAutoRun = dword:145
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://windowsupdate.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1396299708796
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1396297136306
TCP: NameServer = 75.75.75.75 75.75.76.76
TCP: Interfaces\{77D6B68E-0965-40EE-AC3B-019B46274303} : DHCPNameServer = 75.75.75.75 75.75.76.76
TCP: Interfaces\{D98BE35A-BAE6-41F5-BFA8-123C965C5112} : DHCPNameServer = 75.75.75.75 75.75.76.76
mASetup: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "c:\program files\google\chrome\application\35.0.1916.153\installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --multi-install --chrome
Hosts: 75.127.110.7 maddoktor2.com
============= SERVICES / DRIVERS ===============
.
.
=============== Created Last 30 ================
.
2014-06-12 14:00:59 -------- d-----w- c:\documents and settings\all users\application data\Malwarebytes Anti-Exploit
2014-06-02 12:58:09 145408 ----a-w- c:\windows\system32\javacpl.cpl
2014-06-02 12:58:07 96680 ----a-w- c:\windows\system32\WindowsAccessBridge.dll
2014-06-02 12:20:36 -------- d-----w- C:\LXKZ33
2014-06-02 11:57:24 25856 ----a-w- c:\windows\system32\drivers\usbprint.sys
2014-06-02 11:57:24 25856 ----a-w- c:\windows\system32\dllcache\usbprint.sys
2014-05-27 11:40:39 110296 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys
2014-05-27 11:23:46 53208 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys
2014-05-27 11:23:46 23256 ----a-w- c:\windows\system32\drivers\mbam.sys
2014-05-27 11:23:46 -------- d-----w- c:\program files\Malwarebytes Anti-Malware
2014-05-22 15:10:13 26624 ----a-w- c:\windows\system32\drivers\TrueSight.sys
2014-05-22 15:10:13 -------- d-----w- C:\Documents
2014-05-22 15:09:59 -------- d-----w- c:\documents and settings\all users\application data\RogueKiller
2014-05-21 21:23:52 -------- d-----w- c:\documents and settings\all users\Foxit Software
.
==================== Find3M ====================
.
2014-04-20 02:33:54 499712 ----a-w- c:\windows\system32\msvcp71.dll
2014-04-20 02:33:54 348160 ----a-w- c:\windows\system32\msvcr71.dll
2014-04-10 19:56:52 70832 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2014-04-10 19:56:52 692400 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2014-04-09 15:48:58 75640 ----a-w- c:\windows\system32\drivers\hmpalert.sys
2014-04-09 15:48:58 477008 ----a-w- c:\windows\system32\hmpalert.dll
.
============= FINISH: 19:52:26.60 ===============

[pbust]

Try uninstalling Hitmanpro.Alert to see if that fixes the problem.

[MrCharlie]

That did it!

Keep it uninstalled???

Thanks...MrC

[pbust]

Yes, probably best.

I'll close this thread now.