HitmanPro.ALERT Support and Discussion Thread

Hi Cutting_Edgetech

Many thanks for your reply and answer, and that what Nod32 warned about a Potential threat.

With regards
Take Care
TheQuest

 

HitmanPro.Alert 3 Build 167 Release Candidate

runs fine on win 7 32 bit and firefox 37.0 i keep an eye on it

thx

eric

 

No problems with flash 17.0.0.134 and build 167 (W7 64 bits).

 

No problems with plugin Browser Firefox 35 with Brazilian Banks GBPlugin,
IE11 conflict. HMA 167 (W8 64 bits).

 

I updated IE and FF and Chrome Flash Player to v17.0

Which HPA Plugins entry is IE & Which is FF & Which is Chrome

1) c:\windows\syswow64\macromed\flash\flashplayerplugin_17_0_0_134.exe
2) c:\windows\system32\macromed\flash\flashplayerplugin_17_0_0_134.exe
3) c:\program files (x86)\mozilla firefox\plugin-container.exe
EDIT: updated NPAPI and PPAPI

 

The Flash mentioned by HitmanPro.Alert 3 (HMPA) is not for Internet Explorer 11 (IE11) but for browsers like Firefox. The Flash inside IE11 is automatically protected by HMPA since it runs inside the IE11 process - no action required. So you have an outdated version of Flash on your machine.

 

OK ~ so, no HPA plugin entry for IE11....as IE11 Flash is ActiveX

Then is #1 for FF or Chrome / is #2 for FF or Chrome

Flash is embedded in Chrome so, does HPA have a plugin entry for Chrome

 

One is located in C:\Windows\System32 and the other is located in C:\Windows\SysWOW64.
If you click on either, you'd see the path where the file is located.

 

References:
http://www.bleepingcomputer.com/for...pt-ransomware-sets-its-scope-on-video-gamers/
http://labs.bromium.com/2015/03/12/achievement-locked-new-crypto-ransomware-pwns-video-gamers/

 

EMET 5.2 has been released and is currently incompatible with Alert 3 RC (tested Windows 7 x64).

We are working on a solution.
Workaround: disable EAF in EMET 5.2.

EMET 5.1 or older is compatible with Alert 3 RC.

 

W7-x64, HPA build167, and Firefox 36.0.1.

During a clean INSTALL of Flash Player 17.0.0.134 I got this error for the 2nd time,
Yesterday during the UNINSTALL of Glary Utilities 5.20.0.35 was the 1st time:

 

was on bounty rift with my Demonhunter in Diablo III last bounty on tour
then suddenly hpa process stacks with 21,5 % and playin is impossible +
the bad eu server structure from blizzard so i try to cut the damnes hpa
process (Systemexplorer)and i lost the battlenet connection,and so i lost
my d3 progress.

This mess was on HitmanPro.Alert 3.0.32 - Build 167, Release Candidate

i'am so disappointed

 

I just wonder, did you add this game to exploit protection?

 

HMPA latest build and previous builds still showing 2 instances of WordPad under Office exploit mitigation.

 

Java 8 Update 40 (8.0.400.26) did repeatedly finish prematurely with error 1603 with HMP.Alert installed.

I could only successfully install this version of Java after uninstalling HMP.Alert first.

 

Also: Office 2013 Apps do not start with HMP.Alert (build 167, RC) installed.

 

Funny you reported that right now -- I just went to try a manual update for Java, and HMP.A (build 158 ) stopped me from even opening the Java applet in Control Panel: "Attack intercepted -- 'Java(TM) Platform SE binary 8.0.31' has been terminated to prevent execution of malicious code."

The HMP scan didn't turn up anything. FP?

Hoping for instuctions on how to manually update Java now when HMP.A is installed.

UPDATE: I'm also getting intercepted when I convert a Web page to PDF with Adobe Acrobat, and then try to delete pages. The intereception occurs not during the conversion to PDF, but only when I try to delete something from the newly created PDF.

 

I can follow the path...both path folders have ActiveX...so, I'll presume both paths are for IE11...so, Chrome is not listed and Firefox is plugin container.
Why Flash and Plugin Container fly outs upon FF close ?

 

Jeam, just only as a little off-topic remark: I am re-posting your post reply # 4442 but now with the PLAIN tags around it to avoid the smiley in the build-number. (but maybe you can edit your post or maybe a mod would be so kind)

=== repost of JEAM's post ===

Funny you reported that right now -- I just went to try a manual update for Java, and HMP.A (build 158) stopped me from even opening the Java applet in Control Panel: "Attack intercepted -- 'Java(TM) Platform SE binary 8.0.31' has been terminated to prevent execution of malicious code."

The HMP scan didn't turn up anything. FP?

Hoping for instuctions on how to manually update Java now when HMP.A is installed.

=====
=====

EDITED to add: OK, I see your post is edited now

 

Thanks FanJ, I guess our edits crossed in cyberspace!

 

I believe that's because there are two wordpad executables in different folders.

 

Both WordPads listed in HMPA are coming from the same folder location.
(C:\Program Files\Windows NT\Accessories\wordpad.exe)

I can remove mitigations from one and leave other intact and do get flyout from HMPA when running WordPad
so it seems it works. Before though I had only one WordPad listed under Office in HMPA mitigation.
As long as it works correctly I'll go with it.

 

What type of alert do you get? Please post the technical details via PM.

 

No Alert. Just a standard Windows dialog that Excel has stopped working.

Happens every time with HMP.Alert installed and (so far) never with HMP.Alert uninstalled.

I'll PM you the Application Event Error.

 

no i have nothing add,just install hpa and nothing more