HitmanPro.ALERT Support and Discussion Thread

@erikloman

Kickstart on USB on two W10 systems does not work.

System just boots directly to desktop - even after specifying Kickstart USB for boot in Boot Menu.

That is what I am saying - Kickstart USB doesn't work on two separate W10 test systems.

 

I think that is what Erik said.
You can create a Kickstart USB stick on Windows 10, but it cannot be used to boot the Windows 10 sytem.

 

OK, mis-read @erikloman's reply.

Thanks @Stupendous Man .

 

@erikloman
Any plans on fixing compatibility with Office XP? I understand that it's an old product, but it's still commonly used.

 

Thanks to Erik, this is CONFIRMED!

 

I am not aware of a structural incompatibility with Office XP. Will ask the lab to test this.

 

so i see the latest version of hmpalert still hasnt fixed the issue with secure desktop mode for keepass not working , as well as has keystroke encryption messed up the autotype feature of keepass , please fix both these issues , thanks

 

@erikloman
@markloman

HMP.A Colored Window Border - BUG REPORT

HMP.A 3.1.7 build 357
Windows 8.1 Home 64-bit - Clean Install

This Colored Window Border bug can be reliably reproduced at will every time.

 

How?

 

@erikloman

• Download file via browser.
• Set browser to ask\prompt for path when saving file (opens Explorer).
• When Explorer opens, issue occurs.

 

I reckon you download it via Cyberfox on either Win8 or 10.

 

@erikloman

Quirky behavior occurs in all browsers I have tested using Colored Windows Border - Cyberfox, Internet Explorer, Chrome, Firefox - W8.1.

 

BTW, can you give some more info about this:

- Added protection against DLL preloading attacks

 

The hmpalert.exe binary is no longer vulnerable to DLL preloading.

 

OK thanks. BTW, I just read this, not related to HMPA but still interesting:

https://www.fireeye.com/blog/threat-research/2016/02/using_emet_to_disabl.html

 

Thank you!
Also:

 

Will send the strings when a beta comes out.

 

1Password auto-update

Code:

Mitigation   Lockdown

Platform     6.1.7601/x64 06_3a
PID          5596
Application  C:\Users\xxx\AppData\Local\Temp\1Password-4.6.0.604.exe
Description  1Password Setup 4

Filename     C:\Users\xxx\AppData\Local\Temp\is-QQ2U3.tmp\1Password-4.6.0.604.tmp
Created By   C:\Users\xxx\AppData\Local\Temp\1Password-4.6.0.604.exe

Command line:
"C:\Users\xxx\AppData\Local\Temp\is-QQ2U3.tmp\1Password-4.6.0.604.tmp" /SL5="$70946,10278048,227840,C:\Users\xxx\AppData\Local\Temp\1Password-4.6.0.604.exe" /StartAgent=Y

Process Trace
1  C:\Users\xxx\AppData\Local\Temp\1Password-4.6.0.604.exe [5596]
"C:\Users\xxx\AppData\Local\Temp\1Password-4.6.0.604.exe" /StartAgent=Y
2  C:\Program Files (x86)\1Password 4\1Password.exe [4004]
3  C:\Program Files (x86)\1Password 4\Agile1pAgent.exe [4480]
4  C:\Windows\SysWOW64\runonce.exe [4392]
C:\Windows\SysWOW64\runonce.exe /Run6432
5  C:\Windows\explorer.exe [3108]
6  C:\Windows\System32\userinit.exe [4076]

 

@erikloman I can confirm the same behavior on W7/64 with firefox. not often but it appears.

 

Question regarding compatibility with EMET:
Recent posts here seem to indicate that compatibility with EMET is not going to happen. However, in the past, Alert was updated to be compatible with a new version of EMET (5.1 afaik).
So at this point it is not compatible with 5.2 and 5.5, correct?
Will compatibility with these versions come in the future or is this definitively not going to happen because of reasons posted earlier?
Do compatibility problems only apply when a process is protected by both EMET and Alert or also in other cases?

 

What kind of updater is that executing a .tmp file?
"C:\Users\xxx\AppData\Local\Temp\is-QQ2U3.tmp\1Password-4.6.0.604.tmp"

Please uncheck Application Lockdown for 1Password.

 

HitmanPro.Alert 3.1.8 Build 360 PreRelease

Changelog

• Improved CryptoGuard Anti-Ransomware
• Improved BadUSB mitigation
• Improved icon strip under the tiles to better handle double click through.
• Fixed rare BSOD in hmpnet.sys driver

Download
http://test.hitmanpro.com/hmpalert3b360.exe

Please let me know how this version runs on your computer

 

Again a keystroke encryption-issue (build 357).



Win10 1511 build 10586.104 x64/Norton Security with Backup v22.5.5.15

 

Thanks Erik and Dave. Solved.