HitmanPro.ALERT Support and Discussion Thread

Same here.

Win10 1607 build 14393.187 x64/Norton Security v22.7.1.32

 

Thanks Erik! All fine here except for corrupted downloads in Opera with Avira Web Protection on (as has been the case with all builds from 3.5 branch). Since there have been some more reports now on corrupted downloads, I hope you will be able to get to the bottom of the issue

 

Avira net filter and HMPA do not seem to work together. We have posted this to our supplier of the netfilter. Hopefully a fix will be forthcoming.

 

Thanks Erik for acknowledging the issue. Fingers crossed on the fix for this!

 

to counteract New Locky – Zepto Variant? (2)

 

3.5.3 build 561
KeePass master password window = No keystroke encryption bar
Firefox master password window = Yes keystroke encryption bar
Enpass master password window = Yes keystroke encryption bar

any plans for Tamper Protection

 

CryptoGuard v4.5 improves detection for ransomware doing partial encryption.

 

Could it help in that case to exclude opera.exe from the netfilter of HMP.A? (as a temporary fix)

Code:

There is a registry key to disable monitoring per-port, per-IP or per-processname:

HKLM\Software\HitmanPro.Alert\
NetFilterExclude  REG_MULTI_SZ  opera.exe   // do not filter ProcessName opera.exe

If you make changes you have to restart the HitmanPro.Alert service so that it reads the new excludes.

 

Looks pretty cool, it seems to be anti-exploit combined with a HIPS and AV.

https://www.sophos.com/en-us/products/intercept-x.aspx

 

The computers are at a business I support. The next available date I can try the beta there is Friday Sept 23. I will try it then if the testing is still needed

 

"There is a registry key to disable monitoring per-port, per-IP or per-processname:"


This appears not to work here - can anyone confirm that it is actually working, in any case ?

 

One minor glitch on my Windows 7 x64:
With HMP.A setting "Safety notification Once per logon session", after updating 3.5.2.558 to 3.5.3.561 beta, there was no safety notification when opening a protected application.
After another reboot, I got the safety notification when opening the first protected application, as meant to.

 

Do you mean you added PSI 2 to HMP.A's protected applications?
What is the reason for adding PSI 2 to Alerts protected applications?

With PSI 2 not added to HMP.A's protected applications, no issues with PSI 2 and HMP.A 3.5.3.561 beta, on my Windows 7 x64.

 

So far no problems here Windows 7 x64.

 

Yes

I don't know, really. I have only manually added two programs to Alert, the other being Windows Live Mail. Ever since I've been using Alert with exploit protection PSI 2 has been protected by Alert and I have had no problems.

No problem here now so it may of been a temporary glitch. PSI is well known to have server issues from time to time.

 

I tested it with "per-processname", and it's working. But i haven't tested the other option.

 

@Krusty13, #11549,

If PSI 2 has been protected by Alert ever since you've been using Alert and you had no problems, and there's no problem now, yes, then probably it was a temporary PSI 2 glitch. You're right that PSI is known to have server issues from time to time, I've seen it a couple of times, over the years.
Good to know it wasn't a HMP.A issue.

And for adding PSI 2 to Alert's protected applications without a good reason for that, well, if it doesn't cause any issues then it's probably fine. But still, I think best practice would be not to add applications to Alert's protected applications without good reason, as Erik and/or Mark have mentioned.

 

Problem with Bitdefender's Active Threat Control still remains... See this post.

Problem with slow loading of TP-Link router interface still remains... See this post.

Very sad to see that the problem with the TP-Link router exists for more then 6 months now! While the Bitdefender bug exists for about 2 months now! How is that for problem solving!

Uninstalling HMPA... again!

 

No problems here with 561 beta. Win 10 Pro 64(1607), Kaspersky AV, Chrome 64-bit

 

Build 558 b. on Windows 10 v. 1607, no issues because DEP mitigations are disabled.

 

Those are being worked on. Fixes on these are not yet complete so they did not make it in this build. Maybe the next one or the builds after that. For TP Link we need a fix from our netfilter supplier.

 

How do I change the location of (or resize) the orange encrypted text block? On the latest Chrome Hangouts extension, it visually masks the text I am typing and makes editing cumbersome.

 

OK... my bad here... I had overlooked an executable that was tucked away in a subdirectory. Found it when browsing Event Viewer. Added that to exclusions and licensing is now happy.

That said, I'm not sure I understand the "code injection" and how that involved my security software.

Code:

Mitigation   SelfProtection

Platform     6.3.9600/x64 06_3a
PID          6584
Application  D:\Program Files (x86)\DVDFab Passkey\Options\DVDFabPasskeyBluray.exe
Description  DVDFab is the all-in-one software package for copying Blu-ray/DVD and converting video file. 1.0

Stack Trace
#  Address  Module                   Location
-- -------- ------------------------ ----------------------------------------
1  02560000 (anonymous; DVDFabPasskeyBluRay.exe)
            6800005602               PUSH         DWORD 0x2560000
            68412f4500               PUSH         DWORD 0x452f41
            6814e50102               PUSH         DWORD 0x201e514
            e870bbeffd               CALL         0x45bb84
            0000                     ADD          [EAX], AL
            0000                     ADD          [EAX], AL
            0000                     ADD          [EAX], AL
            0000                     ADD          [EAX], AL
            0000                     ADD          [EAX], AL
            0000                     ADD          [EAX], AL
            0000                     ADD          [EAX], AL
            0000                     ADD          [EAX], AL
            0000                     ADD          [EAX], AL
            0000                     ADD          [EAX], AL
            0000                     ADD          [EAX], AL
            0000                     ADD          [EAX], AL

2  02550000 (anonymous; DVDFabPasskeyBluRay.exe)
3  02540000 (anonymous; DVDFabPasskeyBluRay.exe)
4  0044C8AC DVDFabPasskeyBluRay.exe

Code Injection
00190000-001A0000   64KB C:\Program Files (x86)\Charter Security Suite\apps\ComputerSecurity\Common\FSHDLL64.EXE [3820]
00400000-00401000    4KB

Process Trace
1  D:\Program Files (x86)\DVDFab Passkey\Options\DVDFabPasskeyBluRay.exe [6584]
2  D:\Program Files (x86)\DVDFab Passkey\DVDFabPasskey.exe [6644]

Code:

Mitigation   SelfProtection

Platform     6.3.9600/x64 06_3a
PID          3512
Application  D:\Program Files (x86)\DVDFab Passkey\Options\DVDFabPasskeyDVD.exe
Description  DVDFab is the all-in-one software package for copying Blu-ray/DVD and converting video file. 1.0

Stack Trace
#  Address  Module                   Location
-- -------- ------------------------ ----------------------------------------
1  02560000 (anonymous; DVDFabPasskeyDVD.exe)
            6800005602               PUSH         DWORD 0x2560000
            68412f4500               PUSH         DWORD 0x452f41
            68d0e27300               PUSH         DWORD 0x73e2d0
            e870bbeffd               CALL         0x45bb84
            0000                     ADD          [EAX], AL
            0000                     ADD          [EAX], AL
            0000                     ADD          [EAX], AL
            0000                     ADD          [EAX], AL
            0000                     ADD          [EAX], AL
            0000                     ADD          [EAX], AL
            0000                     ADD          [EAX], AL
            0000                     ADD          [EAX], AL
            0000                     ADD          [EAX], AL
            0000                     ADD          [EAX], AL
            0000                     ADD          [EAX], AL
            0000                     ADD          [EAX], AL

2  02550000 (anonymous; DVDFabPasskeyDVD.exe)
3  02540000 (anonymous; DVDFabPasskeyDVD.exe)
4  0044C8AC DVDFabPasskeyDVD.exe

Code Injection
00190000-001A0000   64KB C:\Program Files (x86)\Charter Security Suite\apps\ComputerSecurity\Common\FSHDLL64.EXE [3820]
00400000-00401000    4KB

Process Trace
1  D:\Program Files (x86)\DVDFab Passkey\Options\DVDFabPasskeyDVD.exe [3512]
2  D:\Program Files (x86)\DVDFab Passkey\DVDFabPasskey.exe [6644]

 

You can't change the location but you can hide it.
Go to "Safety Notification", then "Colored Window Border", and untick "Show live Keystroke Encryption in colored window border"