HitmanPro.ALERT Support and Discussion Thread

and remember Direct Access for CryptoGuard w/wo Full Access HMPAlert.

 

Hi all, Origin wasn't working for me for 6 months and today i found out that Hitmanpro alert is the problem.. Has anybody else got problems with origin when they got hitmanpro alert installed? Origin just closes down right after you start it, i emailed surfright today to see if there is any solution. I already tried to disable all the functions in hitmanpro alert but Origin still crashes. The only fix is to uninstall hitmanpro alert and then restarting your pc.

 

No problem at all on my side...

Can i ask you if origin is a protected app (in Alert)?
OS?
Other real-time antimalware??

 

I just checked and origin is not a protected app and i am running windows 10 pro 64 bit. Normally i use Malware bytes premium but i have uninstalled it at the moment when i was trying to find out what programm was causing the origin crashes. I do have norton installed and I am also running version 3.1.8 build. 360

 

@JohnDil

You need to either set:

• Vaccination to Passive [SETTINGS (top right corner) > Advanced interface > Risk reduction > Vaccination]

or

• Add an exclusion for `Origin.exe` [SETTINGS (top right corner) > Advanced interface > Exploit mitigation > Applications > Add exclusion]

 

Thanks Busy!!!

Passive mode didn't fix it so i i added "Origin.exe" + "OriginER.exe" as exclusion. After first reboot it still crashes but after trying to start Origin it did work. Sometimes it did crash so i restarted another 3-4 times and it stopped crashing. Thanks a lot! At last after 6 months or so i can use Origin again lol

 

ok, Norton is the culprit (99,9...%) in your case:
do u want to bet something??

 

I've never had a problem with Origin and Alert and neither did I have to set any exclusions for it to work. As always, another third-party "security"-software could be the culprit.

 

The Sandboxie Version he is using is a beta http://samlab.ws/soft/sandboxie/

 

How do I temporarily disable HMP Alert? I'm very close to uninstalling it for good.

Zoom Player wants to update some of the codecs it uses. However, it is unable to install the LAV Filters update as HMP interacepts it as an attack.

It wouldn't be so bad if there was a prompt asking if I wanted to let it run or not. But, for it to be stopped automaitcally is causing me no end of frustration. I have no idea how to stop HMP stopping the install. I have tried, and given up.

Another nuisance, is that from time to time, HMP is intecepting supposed threats in my browser. For an example, I installed some new software the other day, and at the completion of the install, it attempted to open a webpage. HMP stopped this, and said it had terminated my browser. Since 360 Extreme Explorer uses a seperate process for every tab, only the new brewser tab which was created to open this webpage was shut down, and all the other open tabs were unaffected. In this case there was nothing malicious going on, so there was no reason for HMP to stop the webpage from opening, and it would have been nice to have been given the option to not terminate it.

There have been a few more times in the last few days, where HMP has said it has intercepted threats and terminated browser (well only the tab with suspect contenet gets closed). However, in my day to day usage, I do not get infected, so I have absolutely no reason to believe that anything bad was going on.

Of course I want HMP Alert to intercept actual threats. But for anything else, I would like to be prompted.

 

Can you post an example of an HMPA interception where it shows the details?

 

Apparently Zoom Player is also installs unsigned binaries. Uncheck Application Lockdown on Zoom Player.

 

@erikloman That worked. Thanks for your help.

 

@roger_m,
For test purposes I just installed the free version Zoom Player v11.1 including all available updates (including latest LAV filter setup) as indicated by the install control center. After playing several files I found no issues what so ever.

 

If you install the most recent version, there will be no need for the application to download and install updates during runtime, which is what was causing the lockdown mitigation alert.

 

@FleischmannTV I got the pro version as a giveaway. If I install an updated version it will revert back to the free version. But as I posted, I was able to update the codec by following Erik's advice.

 

This was not directed at you, roger. I was explaining to L10090 why lockdown wasn't triggered in his case, because he already had the latest version, so the player didn't try to download and execute additional binaries.

 

Thank you!

 

@erikloman Can you still respond also on this, MusicBee (portable) music player?

 

No, is not a good idea to disable a core functionality as CFI 'per se'...but in the meantime, if you are unable to listen music...

 

[il rischio, infatti, non è tanto nel fatto che MusicBee di per sè possa essere vittima di un exploit quanto piuttosto che tu ti imbatta in un file audio compromesso]...

the risk, in fact, is not so much in the fact that MusicBee could be the victim of an exploit but rather that you will bump into a compromise audio files...

Avoid to download mp3/[...] until Surfright fixes the 'FP'...

 

@erikloman Can you still respond also on this, MusicBee (portable) music player?

Thanks. I am hoping they can test if the problem is benign ...

 

CFI was triggered also with the latest AIMP 4 but no reply so far from SurfRight ...
https://www.wilderssecurity.com/thr...iscussion-thread.324841/page-328#post-2552611

 

AIMP 4 is performing a ROP technique. For now, simply uncheck Control-Flow Integrity mitigation for AIMP 4.