HitmanPro.ALERT Support and Discussion Thread

Installed HMPA 3.5.2 build 558 pre-release. It is still causing firefox to freeze. Have to click firefox tray icon and select close. The select close program when windows prompts to Close or Wait. This happened on 2 PCs.One a desktop and one a laptop.
Both Win 10 anniversary. If HMPA is uninstalled, the problem goes away. this has happened with the last several versions. I am running the 64 bit version of firefox.

 

@erikloman
@markloman

Explorer.exe crashes with b557.

Spoiler: Metadata

Code:

<?xml version="1.0" encoding="UTF-16"?>
<WERReportMetadata>
    <OSVersionInformation>
        <WindowsNTVersion>6.1</WindowsNTVersion>
        <Build>7601 Service Pack 1</Build>
        <Product>(0x1): Windows 7 Ultimate</Product>
        <Edition>Ultimate</Edition>
        <BuildString>7601.23418.amd64fre.win7sp1_ldr.160408-2045</BuildString>
        <Revision>1130</Revision>
        <Flavor>Multiprocessor Free</Flavor>
        <Architecture>X64</Architecture>
        <LCID>1055</LCID>
    </OSVersionInformation>
    <ProblemSignatures>
        <EventType>APPCRASH</EventType>
        <Parameter0>Explorer.EXE</Parameter0>
        <Parameter1>6.1.7601.17567</Parameter1>
        <Parameter2>4d672ee4</Parameter2>
        <Parameter3>ole32.dll</Parameter3>
        <Parameter4>6.1.7601.19131</Parameter4>
        <Parameter5>569a9398</Parameter5>
        <Parameter6>80000001</Parameter6>
        <Parameter7>0000000000179b94</Parameter7>
    </ProblemSignatures>
    <DynamicSignatures>
        <Parameter1>6.1.7601.2.1.0.256.1</Parameter1>
        <Parameter2>1055</Parameter2>
        <Parameter22>615a</Parameter22>
        <Parameter23>615ac103077875ce3f0c98cf45efba70</Parameter23>
        <Parameter24>17c0</Parameter24>
        <Parameter25>17c038ac96f91e9655ff20258974cde6</Parameter25>
    </DynamicSignatures>
</WERReportMetadata>

 

Build 558 has just been released.

#11299

 

Just purchased a 3 year licence, tried to active HMP.Alert and it says "the entered product key is not suitable for this product"

Am I doing something wrong?

 

@Krusty13

Thanks. b558 works fine.

 

Build 558 has fixed 556/557 issues with black-screen and chrome extensions crashing,

but MPC-HC has still to be excluded manually, and Photoshop-Elements needs Control-Flow-Integrity to be disabled...
I don't want to complain, but there should be an exception for most popular Applications.

I suggest a cloud based whitelist for know good applications, that interfere with HMP.A

 

Working good here on Windows 7 x64.

 

This is great news. Wish I could attend there. I hope that you will record that and share it with us via YouTube or something. I will keep an eye on Intercept X as I've been asking and waiting for something like that for quite a while already.

 

many developers have the attitude you just said but I think it is wrong, a manual is part of the product in my view.

It also shouldnt be particurly a time consuming task to have one either.

My main concern now is the false positives, I am not sure what view I take currently.

EMET when I used to use also had false positives, and arguably those were more severe as EMET developers never took action to resolve those false positives so e.g. to prevent firefox from cashing I disabled ROP protection, whilst HMPA can run firefox with ROP protection.

However the issue with HMPA is how it hooks to everything running on the system by default which means false positives can crash installers, security software and other stuff. Which can be much more damaging than crashing a browser session. This approach actually conflicts with the advice that was given to me when I first started using HMPA, some may remember I originally asked about adding stuff like svchost and explorer to HMPA and I was told one shouldnt be adding every executable to the protection as stability is compromised yet HMPA seems to hook onto everything anyway unless its manually excluded.

Of course the other gain with HMPA is it is much better performance wise than EMET, if an exe was added to EMET with most protections enabled, then the performance drop off was very visible, this is not the case with HMPA. I am still going to use HMPA but with these concerns, thankfully the false positives I have had have been mostly on my win10 testing machine rather than this desktop.

 

Btw do you know/have any plans to integrate Sophos Intercept X with major MSP systems like Kaseya or LabTech?

 

in my view this should be a priority, when interaction is added then false positives are no longer such an issue.

 

Their are much less hooks in non-mitigated applications. Also the amount of code in these smaller number of hooks is much less. Still there are a few applications that do not like to be injected (mostly games and third party AVs).

 

This is high on our list, but due to resource constrains this did not make it in. It is already in Alert but not yet fully implemented and therefor disabled. Note though that it does NOT work on per-alert basis where you have to say allow/block.

 

Cloud-assisted whitelisting is in this build but not yet fully operational due to resource constraints. Keep an eye out for this in the next builds!

 

thanks for the replies erik, I think will stick with build 546 for now as some of the bugs (the black screen boot issue especially) I find scary. I will wait until a release gets posted with no issues reported.

 

No problems upgrading build 558 PR.

Win10 1607 build 14393.105 x64/Norton Security v22.7.1.32

 

@erikloman @markloman
I've sent you PM's about this issue.
Should I be emailing support instead?

UPDATE: Erik has kindly resolved the issue

 

no problem here with 558

 

Had a false positive with internet explorer using 556, but 558 working well for me.

 

Updated HMP.alert from build 546 to build 558.
Both W7-x64 and W10-x64 AU are running without issues!

 

Enterprise licenses is missing, that is a HUGE difference.

 

I take it from the new website that the Enterprise license has been dropped? Where does that leave my 130 user license when I come to renew it?

 

Oops, I compared the new price to the 3PC license

 

I'm covered for the next few years because of the last Black Friday deals but it would be good if Wilders' beta testers could get a reasonable discount. The new prices are well above what I can afford to pay, and above what I'm prepared to pay.

... And my licenses cover both HMP.A and HMP.

 

Erik has said in this thread that after a certain date that HMP and Alert had separate licenses.

I know! You obviously don't understand what I wrote, but that's OK.