HitmanPro.ALERT Support and Discussion Thread

So far so good on Win7 Ult.(64)
USB keyboard message is gone.

 

German version still says "Tastaturschlag Verschlüsselung"

There is no such word in german language. see: http://www.duden.de/suchen/dudenonline/Tastaturschlag

As "Tastaturschlag Verschlüsselung" is to long anyway, my suggestion is: Tastatur Verschlüsselung

 

Build 178 is running great here. The issue with Shellcode alert when opening Windows Live Mail is resolved.

Thanks.

 

Build 178 and previous versions gave me an alert, when I started Color-Filters from NIK-Filter-Collection, within Photoshop-Elements 11.
I had to disable IAT, to avoid alerts.

http://abload.de/img/hmpalertagqll.jpg

 

build 178 RC

 

W7-x64, hp240, upgrade hpa 177 -> 178, FF 37.0, IE11,...

No issues/problems at all.

 

Thanks for the input. The German translation was done by a native German who is active in the computer security business (professionally) for many, many years. And yes, the word is not registered in the official German dictionary, a Google Search for "Tastaturschlag" returns over 2500 hits. Even though that's not many, I'm led to believe that the word is informally used by the German population.
A Google Search for "Tastatur Verschlüsselung" returns about the same amount of hits. So, what to do?
We'll leave if at is for the time being. If you have other remarks, let us know!

 

Hi. I'm native german. It's no hard mistake, it's ok. "Tastatur Verschlüsselung" would be worser IMO. A solution could be "Tastaturanschlag Verschlüsselung" but the best (esp. in technical sence) is "Tastatureingaben Verschlüsselung". But maybe it is both to long?

Background: Tastaturschlag or Tastaturanschlag is the hardware thing. (how easy or fast I can type with keyboard xy, how comfortably are the keys etc.) Tastatureingaben is what happens and what is encrypted by alert.

Another thing in german translation, but also a small issue what is not completely wrong:

"Schützt Anwendungen gegen aktuelle und zukünftige Angriffe anhand System-Schwachstellen"
better would be
"Schützt Anwendungen gegen aktuelle und zukünftige Angriffe durch System-Schwachstellen"

 

Confirmed fixed with 178

 

Surfright (circle) is so close to the German border (arrow), they could hire a native german translator who could go to office on his biccycle

 

After update from 172RC to 178RC I got this.

 

ROP Alerts with Firefox 37 on Youtube(FF now defaults to HTML5 video) in combination with Webroot SecureAnywhere, no alerts when Identity Shield is disabled.

 

Turn off Load Library mitigation for Avant Browser. We'll look into it later. Thanks!

 

HMP.Alert 3 build178 RC running smooth on Firefox 37 / Win7.1 Premium x64
USB keyboard message is gone.
Problem with no issue is that it brings no information. Still, I won't say I'm sorry about that. Hmm...

 

After installing build 178 (I came from build 172) I have problems with Thunderbird. When I start Thunderbird, the flyer appears but the interface never shows. In Task Manager I can see that the thunderbird.exe process is active (very active) and it stays that way using a lot of processor time. When I quit the process and try to start it again... the same thing happens but sometimes I'm lucky and the Thunderbird interface does appear and I can do my thing, but most of the time... nope. Only after disabling the 'Load Library' function for thunderbird.exe the issue seems really gone.

 

In what HitManPro.Alert "category" have you set Thunderbird? I've included Thunderbird within OFFICE (as advised elsewhere on this thread) and I've encountered no issue up to now.

 

Yes Thunderbird is in the OFFICE category as the advice was. Do you have 'Load Library' enabled?

 

Yes, all mitigations are enabled here for Thunderbird set in OFFICE...
The strange thing is that you've encountered the issue you describe above only with latest HMP.Alert 178 as I understand it.
I guess you're aware of not having installed/modified any code related to Thunderbird since HMP.Alert 172?
Otherwise your issue requires the developer's analysis ... I'm afraid I cannot dig any further than a basic, elementary approach.

 

http://blog.emsisoft.com/2015/03/29/vaultcrypt-ransomware-offers-fake-customer-support/
http://blog.emsisoft.com/2015/03/14/new-cryptolocker-variant-attacks-games/

 

Both are blocked by Alert 3.
https://twitter.com/markloman/status/581188296354754560
https://twitter.com/markloman/status/576125620230492161

 

We will have a look at the issue. Thanks for reporting.

 

We did hire a native translator.

 

Mitigation DEP

Platform 6.3.9600/x64 06_45
PID 11808
Application C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
Description Google Chrome 41

IP = 1C50B9C0, State = 0x1000, Type = 0x20000, Protect = 0x4

Stack Trace
# Address Module Location
-- -------- ------------------------ ----------------------------------------
1 2EE440BA (anonymous; chrome_child.dll)
8b75fc MOV ESI, [EBP-0x4]
83c404 ADD ESP, 0x4
e92c000000 JMP 0x2ee440f1

2 2EE4566A (anonymous; chrome_child.dll)
3 2EE4EF62 (anonymous; chrome_child.dll)
4 2EE4ECAC (anonymous; chrome_child.dll)
5 2EE0A61B (anonymous; chrome_child.dll)
6 2EE4F143 (anonymous; chrome_child.dll)
7 2EE4ECAC (anonymous; chrome_child.dll)
8 2EE0A61B (anonymous; chrome_child.dll)
9 2EE4F143 (anonymous; chrome_child.dll)
10 2EE4ECAC (anonymous; chrome_child.dll)

 

Protect = 0x4. This means that the page is not executable (0x4 = PAGE_READWRITE, compare to PAGE_EXECUTE_READWRITE).
Are you running an old plugin?

Do you get the message consistently?