HitmanPro.ALERT Support and Discussion Thread

W7-x64 with hmpa build 191.
Desktop has wireless mouse Logitec M215, Driver: Microsoft 6.1.7600.16385, NO scrolling flyouts, everything works fine for IE11 and FF39.0.4
Laptop has Thinkpad USB attached mini-mouse, also Driver: Microsoft 6.1.7600.16385, NO scrolling flyouts, everything works fine for IE11 and FF39.0.4

 

Keystroke encryption was previously working unpredictably - I assumed it could be due to contention with WSA Identity Protection which has an anti-logger. But with build 191 keysroke encryption is working as expected (Firefox 38.0.5, Windows 8.1 Pro x64).

 

Firefox keystroke encryption okay. 191
No scrolling flyout with HP wired mouse w Microsoft Driver.
f2 f3 render backward slash in flyout which as it turns out is not odd. As my top row f6 thru f11 renders letters in flyout. Who knew.. never noticed top row before 191

 

I was previously running build 189 and not seeing the live encryption indicator in Internet Explorer (32 bit); it works fine in build 191. Also working fine in Firefox and Chrome.

By the way I also see the live encryption indicator intermittently when scrolling in Firefox. I have a Logitech K520 wireless keyboard and mouse with a unified usb adapter.

Edit: Unified driver for mouse and keyboard is Logitech v5.33.10.0 dated 9/1/2011

 

Perhaps it helps ErikLoman if the people, who experience random scrolling flyouts with build 191, specify their mouse driver (from Windows 'Device Manager').

 

@erikloman

What about this issue?

 

Try forward slash. I get Quick find box

 

Is there any compatibility problem between HMPA and Media Player Classic?

 

One some computers you'll have to disable mitigations because of constant alerts. On my own computer, there is no problem, never has been. On my father's on the other hand I couldn't even open a single file.

 

All right, I got the chance to try the ESET Online Scanner via Firefox.

The scanner is running normally right now, there was no interception.

As a control, first I tried again to run the scanner in IE8. Got the same interception by HMP.A as the last time.

 

I tried here with Media template and didnt see any alert or problem for now, maybe it is a hardware thing.

 

No problem with MPC-HC 64-bit 1.7.8.237

 

PhraseExpress (a PC clone of Mac App TextExpander, which replaces short texts entered by longer ones, like expanding "xeml" to "info@surfright.nl" or "xadr" to"
SurfRight B.V., Postbus 960, 7550 AZ Hengelo") no longer works in Firefox with HMPA build 190, unless I disable keystroke encryption.

It worked with some previous builds, but perhaps only because keystroke encryption did not work properly in those builds?

Is there a way to "whitelist" PhraseExpress? (enable keystroke encryption and use PhraseExpress)

 

phraseExpress works exactly like a keylogger, it sniffs keystrokes. When it sees a combination of keys it expands the typed word. If you use these tools you need to disable any keystroke encryption. I guess that Zemana or KeyScrambler doesnt work with PhraseExpress either.

 

If I manually add MPC-HC x64 with profile Media to the protected programs I must uncheck 'Null Page Mitigation' before I can run it.

But what would be the reason to manually add MPC-HC x64 to the HitmanPro.alert protected programs?

 

Still not working. Keystroke Encryption works right after install, all browsers, but after a reboot it stops working again. Currently no other security software installed except what comes with Windows 8.1.

 

i installed HMPA b191.. the good news is it still seems to function properly: i got another ROP alert when i tried to attach a file to a post in a forum.. the bad news is i still get a ROP alert when i try to attach a file to a post in a forum..

yea, i am harping on it i am hoping that this issue can be addressed..

i don't get the ROP alerts when firefox is run outside of "sandboxie"..

i was concerned that there might be problems with HMPA b191 since it was tweaked, to accommodate the "norton" av-program.. now we need it to be tweaked to accommodate "sandboxie"..

i will mention something else.. when i first tried using HMPA, the updates for the HMPA program would not download, on my computer, or so it seemed.. in fact, the update did download, one time, that i noticed: i was emptying my TEMP folder and i happened to notice that the HMPA-update-file was there, but it was too late for me to stop what i was doing, which was emptying the TEMP folder, and the file was deleted, along with the other files in my TEMP folder.. so, whether the HMPA-update file wasn't downloaded, or it was downloaded but didn't run, either way, i wasn't getting the update for the HMPA program..

i didn't know why i wasn't getting the update for the HMPA program when other people were getting it.. and, as i said, apparently i did actually get the file, it just didn't run.. now that i have thought about it, maybe "sandboxie" was preventing the file from running: i have the TEMP folder "forced" to run in "sandboxie"..

so..i wasn't really worried about not getting the HMPA update automatically (other than wanting to know what the problem was).. i figured i would just install it manually..no problem.. however..i still have a problem with HMPA's logging "events" in my windows event-viewer, saying "update failed"..

here is what the "event" shows:

Event Type: Warning
Event Source: HitmanPro.Alert
Event Category: Installer
Event ID: 214
Date: 6/13/2015
Time: 5:35:51 AM
User: N/A
Computer: user-PC
Description:
Check for update has failed. Trying again in 120 minutes.
---------------------------------------
(i would have posted a screenshot except that HMPA won't let me attach it to my post.. i would get a ROP alert if i tried to attach a screenshot to my post)..

i can understand the HMPA-update's failing since i have HMPA b191 installed and the one on the update-server is b187..

the point is:

1. i wish HMPA had an option for turning off its automatic-updating.. then my windows events-log wouldn't be filling up with HMPA-update-failed-warnings..

2. i wish that one actually could use the button, in HMPA's context-menu, to check for updates, as opposed to its being greyed out and disabled, saying "no updates available".. it i could actually check for updates, if there was a problem with updating HMPA, it might help me to figure out what the problem was..

as long as i can manually install the HMPA-updates, i don't see a problem, there.. i am happy to do it manually, as long as i can download the update.. i just want to be able to turn off HMPA's automatic-updating, so that it doesn't continually log "update-failed" warnings in windows "events"..

thanks

 

To me, that seems to be a recipe for trouble.
If Sandboxie prevents temp files to be ran as supposed to, I guess that will mean some things may not work as expected.
I don't know if this affects HMPA, but I could imagine it to be a factor in certain issues.

By the way, are you talking about C:\temp or C:\Windows\temp
or even another temp folder, like \appdata\Local\Temp or \appdata\LocalLow\Temp ?

 

peter, are you saying that you use both "firefox" and "sandboxie" and that you are not seeing the same problem that i mentioned, where i get HMPA-ROP-alerts when attaching files to posts? if that is the case, then maybe the difference is the OS's that we are using.. i am using windows xpsp3..

i was wanting to know if anyone else who uses both "firefox" and "sandboxie" was having the same problem..

yea, i understand your saying that maybe it is something specific with my computer that is causing the problem but the only possible "problem" that i can think of is that i am using windows xpsp3.. on second thought, i could do some tests, to see if disabling some programs on my computer makes a difference..

i use the "avira" av-program (not the norton av-program).. what i like about it is that it is, pretty much, a plain, simple, av-program..no HIPS features, at least not that i use..

i believe that the only other two programs that i have running are "regdefend" and "system safety monitor".. i have been using both of those programs for around 10 years and neither of them has ever caused me any problems..

 

I found a bug with the Bad USB protection. I DISABLED it, but when i start my computer and have plugged in my usb receiver for my wireless headset, then my computer gets somehow locked, i can't press anything but i can move the mouse, keyboard also stops working. I need to unplug the usb receiver and restart. Following window is displayed but you can't press anything, it also doesn't go fullscreen:

http://i61.tinypic.com/2u4huli.jpg


Ps. I haven't tried build 191 yet, i am still on 190, not sure if this has been fixed in 191.

 

the only issue i am having is the HMPA-ROP-alerts, relating to "firefox", which occur when i try to attach a file to a post, and it only happens when firefox is run within "sandboxie"..

i also get ROP-alerts when i try to run IE in "sandboxie", but that is not a problem for me since i normally don't run IE in "sandboxie"..