HitmanPro.ALERT Support and Discussion Thread

HitmanPro.Alert 3.6.3 Build 580 BETA

We have received several minidumps from members here which led to this build. Thank you!!

Changelog (compared to 578 )

• Fixed BSOD in CryptoGuard
• Fixed BSOD in WipeGuard

Notes
All drivers are co-signed by Microsoft in this build

Download
http://test.hitmanpro.com/hmpalert3b580.exe

Please let us know how this build runs!

 

thanks trying it now.

 

I never had an issue with 578 or 579 but I've installed 580 just in case - no problem so far.

 

@erikloman no more issues thanks.

 

And again no problems upgrading build 580 beta.

Win10 1607 build 14393.693 x64/Norton Security v22.8.1.14

 

All well on my Windows 7 x64.
If any issue might show later, I will report, of course.

 

580 Beta has been running smoothly for just over an hour with no BSODs. I have F-secure and Appguard. Thank you for the fix.

 

I don't know what could have been the cause of that. Perhaps Erik or others may have any idea.
But anyhow, there is no need to uninstall before upgrading. You can simply run the installer to upgrade, no need to uninstall first.

 

I was one of those affected by BSODs. Running AppGuard and EAM FWIW.
580 seems to have fixed the issue, so far at least. No BSODs after initial or second reboot.
Win 10 Pro x64 v1607 14393.693.
Thanks for the prompt fix.

 

Initial testing confirms that b580 fixes the BSODs I was getting with Avira on W10x64.

 

Hitman Alert pro fails in detecting Cerber5 ransomware.

http://imagizer.imageshack.com/img924/2999/bZ9oU9.jpg

Code:

C:\WINDOWS\system32\OLEACCRC.DLL (successful)
\\.\PIPE\lsarpc (successful)
\\.\MountPointManager (successful)
C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\nsw1.tmp (successful)
C:\222bb4e588b0865f36047b4eb2e725c715a289898bc630b1245c46a0289522ff (successful)
C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\armenian-nola-link.png (successful)
C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\jquery-click.js (successful)
C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\html5shiv.js (successful)
C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\ajax-loader.gif (successful)
C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\jquery.selectbox.css (successful)
C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\mlbo0r1FnMS.XyEdKpuOItANsYM (successful)
C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\nsg2.tmp (successful)
C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\nsg2.tmp\System.dll (successful)
C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\nsg2.tmp\System.dll (failed)
C:\WINDOWS\system32\ntdll.dll (successful)
C:\WINDOWS\system32\rsaenh.dll (successful)

 

Thanks for letting us know. How did you test the sample? Did you just extracted it from the pcap or did you test it by replaying the RIG-v exploit kit attack, which distributes this Cerber. CryptoGuard is the last line of defense. A real-world test would also involve replaying the exploit kit attack. In the meantime, I'm taking a look-see! Thanks again!

Update: I've just checked it against the current HitmanPro.Alert (build 574) and even when running the ransomware manually (not from exploit kit), it is stopped - no data lost:

 

Installed build 580, but 578/579 also worked fine in combination with EIS on my system.

 

Build 580 still hasn't fixed my BSOD when inserting a USB protected by bitlocker. I will send another minidump.

 

Upgraded from 579 to 580 without incident. No issues to report

 

Running Bld 580 along with AppGuard and EIS without any problems

 

Likewise...test running Build 580, with Webroot SecureAnywhere & VoodooShield, and there are no conflicts or issues to report.

 

So far no problems.

 

No issues with previous build but 560 running well with VS & SBIE on Win 10x64 Pro

Thanks

 

HMP.A 3.6.3 build 580 BETA

Windows 10 x 64 with Emsisoft and VoodooShield. It runs well so far.

 

W7-x64 Professional:
Upgraded from 579 to 580 without incident. No issues with both builds 579 and 580.

 

I still see the same bug I reported in post #12401. Since the Windows 10 anniversary update Cortana searches started using the Win+S or Win+Q shortcut show encrypted text when keyboard encryption is enabled.

 

Just wanted to contribute that Opera beta's auto-update mechanism as well as the Uninstall is blocked by HMPA. As well as the actual Install on a reinstall attempt:

Mitigation Lockdown

Platform 10.0.14986/x64 v579 06_3c
PID 20048
Application C:\Program Files\Opera beta\launcher.exe
Description Opera beta Internet Browser 43

Filename C:\WINDOWS\TEMP\opera autoupdate\installer.exe
Created By C:\Program Files\Opera beta\launcher.exe

Command line:
"C:\WINDOWS\TEMP\opera autoupdate\installer.exe" --version

Process Trace
1 C:\Program Files\Opera beta\launcher.exe [20048]
"C:\Program Files\Opera beta\launcher.exe" --scheduledautoupdate --autoupdaterequesttype=manual
2 C:\Windows\System32\svchost.exe [1540]
c:\windows\system32\svchost.exe -k netsvcs -s Schedule
3 C:\Windows\System32\services.exe [1004]

Thumbprint
106897119c2878a3dd4f2f945ae423d0300a2049271031695026d501e8850e65

 

Opera 44 Developer auto-update mechanism is triggering this attack blocking too.