HitmanPro.ALERT Support and Discussion Thread

I don’t do that.

I do however have the TEMP/TMP variables set to a location on a RAM disk and always thought that was the reason… (as files in/on there are obviously gone after a reboot)

Guess I have been wrong about that, seeing the path you mention.

 

Auto-updated to 3.8.18 Build 921 a couple of days ago. I have not experienced any issues.

 

Auto-updated to 3.8.18 Build 921 today on two machines and as a result, Chrome 96.0.4664.45 (64-bit) opens but crashes right away (Aw, Snap!). Getting Error Code: STATUS_ACCESS_VIOLATION. I can see that the only 3 extensions I run were crashing (Decentraleyes, Privacy Badger, AdGuard). Then I noticed if I did not force Chrome to open in Sandboxie, the browser runs fine. Only thing I changed on my systems was HMP.A update.

 

Anyone else running in to this? I can't seem to replicate this with the 3 extensions and AdGuard for Windows installed.
Sandboxie 5.33.3 - Last Sophos edition.

 

Maybe Page42 uses Sandboxie Plus by David Xanatos.

https://github.com/sandboxie-plus/Sandboxie/releases/tag/1.0.0

 

Sandboxie 5.33.6 (64-bit) here.

 

Ronnie T - I got this email today and all 3 links don't work and get a 404 code...
Plan ahead: Know who to contact when a cyberattack strikes.[/USER]

 

Another question... per tech support suggestion I have uninstalled 921 and reverted to 907. That quickly fixed Chrome and the Error Code: STATUS_ACCESS_VIOLATION. Question becomes, what should I do when I get the update notification saying HMP.A will update on next reboot? I don’t recall there being a way for me to stop that update, but that’s what I will want to do. TY

 

Another question... how does a user copy the details of an intercepted attack? So far I am just doing screen captures when I get an attack notification, but there must be a log file showing all the details. TY

 

On main panel, Last Event>Actions>View alert details.

 

TY for your reply, paulderdash. Yes, I see that, and I have made screen captures there, but I am looking for a text file, like a log file, that I can copy, maybe send to a tech support person. There is no ability to copy (& then paste) the attack details.

 

Double click on the event > click on the Details > Ctrl+ A to highlight text > Ctrl + C to copy text > To paste it here (or elsewhere) Ctrl + V.

EG:

Spoiler: Sample Event

Mitigation CallerCheck
Timestamp 2021-11-04T12:55:14

Platform 10.0.19043/x64 v915 06_5e
PID 12468
WoW x86
Feature 007D1A361FBF01B6
Application C:\Program Files (x86)\Kaspersky Lab\Kaspersky Password Manager 9.0.2\kpm.exe
Created 2021-08-16T04:15:18
Description Kaspersky Password Manager 9.0.2

Callee Type CreateProcess
C:\Program Files\Mozilla Firefox\firefox.exe

0000000a:f5591d916634164a325b9a3b4c23d6f341d5eeb818c1aa4af3e6e69474dffc08

Stack Trace
# Address Module Location
-- -------- ------------------------ ----------------------------------------
1 0A47193B (anonymous; clr.dll)
c6460801 MOV BYTE [ESI+0x8], 0x1
833d4830455e00 CMP DWORD [0x5e453048], 0x0
7407 JZ 0xa47194f
50 PUSH EAX
e8a2a99553 CALL 0x5ddcc2f0
58 POP EAX
c745e800000000 MOV DWORD [EBP-0x18], 0x0
8bf8 MOV EDI, EAX
e873c88b53 CALL 0x5dd2e1d0
8bc7 MOV EAX, EDI
8b7ddc MOV EDI, [EBP-0x24]
897e0c MOV [ESI+0xc], EDI
8d65f4 LEA ESP, [EBP-0xc]
5b POP EBX
5e POP ESI
5f POP EDI

2 0A4715DE (anonymous; clr.dll)
3 0600FDE5 (anonymous; clr.dll)
4 078E0E1A (anonymous; clr.dll)
5 0600FBA0 (anonymous; clr.dll)
6 0600FAA2 (anonymous; clr.dll)
7 0600FA75 (anonymous; clr.dll)
8 0600FA24 (anonymous; clr.dll)
9 0600F7F1 (anonymous; clr.dll)
10 0600F78A (anonymous; clr.dll)

Loaded Modules (183)
-----------------------------------------------------------------------------
00A30000-00AE8000 kpm.exe (AO Kaspersky Lab),
version: 9.0.2.19011
74DE0000-74EF2000 hmpalert.dll (SurfRight B.V.),
version: 3.8.17.915
74CC0000-74D5E000 0patchLoader.dll (Acros Security),
version: 21.05.05.10500
5E700000-5EFE6000 kpm_engine.dll (AO Kaspersky Lab),
version: 9.0.2.19011
5E660000-5E6FE000 crypto_sqlite3.dll (),
version:
73BD0000-73CD6000 dblite.dll (SQLite Development Team),
version: 3.35.5
73D20000-73F05000 app_core.dll (AO Kaspersky Lab),
version: 30.673.0.240
72EC0000-72F4C000 prremote.dll (AO Kaspersky Lab),
version: 30.673.0.240
72BC0000-72C33000 prcore.dll (AO Kaspersky Lab),
version: 30.673.0.240
741A0000-741A9000 pxstub.ppl (AO Kaspersky Lab),
version: 9.0.2.19011
74180000-7419F000 params.ppl (),
version:
72490000-729AB000 instrumental_services.dll (AO Kaspersky Lab),
version: 30.673.0.240
72CF0000-72D62000 licensing_meta.dll (AO Kaspersky Lab),
version: 30.673.0.240
723D0000-72490000 app_core_meta.dll (AO Kaspersky Lab),
version: 30.673.0.240
73B90000-73BC5000 ocr_meta.dll (AO Kaspersky Lab),
version: 0.8.3.0
722E0000-723C7000 ps_meta.dll (),
version:
72280000-722E0000 ksn_meta.dll (AO Kaspersky Lab),
version: 30.673.0.240
73F50000-73F5E000 crypto_components_meta.dll (AO Kaspersky Lab),
version: 30.673.0.240
721E0000-72272000 kl_remote.dll (AO Kaspersky Lab),
version: 30.673.0.240
5C120000-5C277000 ucp_meta.dll (AO Kaspersky Lab),
version: 30.673.0.240
72180000-721DA000 updater_meta.dll (AO Kaspersky Lab),
version: 30.673.0.240
72130000-72179000 storage.dll (AO Kaspersky Lab),
version: 30.673.0.240
66C40000-66E69000 crypto_components.dll (AO Kaspersky Lab),
version: 30.673.0.240
66910000-66B81000 crypto_ssl_1_1.dll (The OpenSSL Project, htt),
version: 1.1.1k
5BA90000-5C11E000 kpm.dll (AO Kaspersky Lab),
version: 9.0.2.19011
5BA00000-5BA87000 infra.dll (),
version:
72FB0000-731E0000 app_core_legacy.dll (AO Kaspersky Lab),
version: 30.673.0.240
5B770000-5B9F2000 ucp_agent.dll (AO Kaspersky Lab),
version: 30.673.0.240
5B740000-5B764000 agreements.dll (AO Kaspersky Lab),
version: 30.673.0.240
5B5E0000-5B73F000 ksn_facade.dll (AO Kaspersky Lab),
version: 30.673.0.240
63DF0000-63FA4000 antimalware_provider.dll (AO Kaspersky Lab),
version: 30.587.0.880
73B70000-73B90000 propmap.dll (AO Kaspersky Lab),
version: 30.673.0.240
73F30000-73F3E000 schedule.dll (AO Kaspersky Lab),
version: 30.673.0.240
73B60000-73B67000 regmap.dll (AO Kaspersky Lab),
version: 30.673.0.240
72FA0000-72FA7000 timer.dll (AO Kaspersky Lab),
version: 30.673.0.240
72F90000-72F9C000 thpimpl.dll (AO Kaspersky Lab),
version: 30.673.0.240
5E5E0000-5E5F5000 rpc_server.dll (),
version:
5E570000-5E5D7000 kpm_integration.dll (AO Kaspersky Lab),
version: 21.3.10.391
5C640000-5C663000 vkbd2.dll (AO Kaspersky Lab),
version: 21.3.10.391
59710000-59BD9000 kasperskylab.kpm.nativeinterop.dll (AO Kaspersky Lab),
version: 9.0.2.19011
0B2B0000-0B4D3000 igdumdim32.dll (Intel Corporation),
version: 25.20.100.6446
14150000-176CE000 igd9dxva32.dll (Intel Corporation),
version: 25.20.100.6446
66640000-6664D000 UMPDC.dll (The OpenSSL Project, htt),
version: 1.1.1k
51920000-51A50000 ipm_service.dll (AO Kaspersky Lab),
version: 30.673.0.240
089C0000-089C8000 transport_proxyps.dll (AO Kaspersky Lab),
version: 9.0.2.19011
- MS skipped (13 -

Process Trace
1 C:\Program Files (x86)\Kaspersky Lab\Kaspersky Password Manager 9.0.2\kpm.exe [12468]
"C:\Program Files (x86)\Kaspersky Lab\Kaspersky Password Manager 9.0.2\kpm.exe" autoStart
2 C:\Program Files (x86)\Kaspersky Lab\Kaspersky Password Manager 9.0.2\kpm_service.exe [4808]
3 C:\Windows\System32\services.exe [916]
4 C:\Windows\System32\wininit.exe [752]
wininit.exe

Services
4808 kpm_launch_service

Dropped Files

Thumbprints
885aa07e0193d43fff4fb6c54707aaaf6633cbe79ed461da03f4c5de3ea4a923
6362c99c17312984d5280378e3e4efc1af2f4866dfe79a4e975a5886602002cf (backward compatible)

 

That helps, Krusty. The highlighting is sporadic, requires a number of attempts, but I can now C&P the alert details into a text file. I definitely was not using the Ctrl + A to highlight text. Appreciate the help.

Do you by any chance know how to not accept a HMP.A upgrade when it is offered on next reboot? I have always wanted the update, and so I never looked for an option to say no thanks. For the time being, I need to stick with 907 and leave 921 alone.

 

I kind of remember there might be a registry tweak but I'm not sure. Someone would have to confirm that for you.

One thing that might work, delete temp files before a machine restart. CCleaner, Privacy Eraser or similar make that job easier. You will be prompted to update again next time you restart though.

 

Yes, I run Privacy Eraser prior to restart and doing so has not stopped the update. I really am curious now as to how a user can suppress a HMP.A update. Kind of seems forced the way it is currently set up. I have asked this question in an email to support, so hopefully they get back to me. TY, Krusty.

 

Troubles with HMP.A continue.

In addition to waiting to hear if there is a way for me to stop a HMP.A update when the desk top notification pops up saying the update will occur on next reboot. How do I prevent that if I wish to stay with the current version? Eventually I will surely want that update, but until another issue is resolved, wherein I was advised to revert to a prior version, having the new one forced onto my system at reboot puts me back at square one... causing me to have to uninstall the new, reinstall the previous one, etc.

I am also experiencing something I THINK I have seen other users post about in this thread... that is suppressed alerts that do not stay suppressed. In other words, the same alert shows up numerous times, even though I have suppressed it, and it currently says it is SUPPRESSED. What if anything was recommended to fix that?

 

Hi Page42,

@RonnyT sent me a PM about a similar issue I was having with SandBoxie Plus. He said that alert shouldn't show up as it was suppressed internally, yet it did. I'm not using SandBoxie Plus anymore for other reasons.

Block HMP.A in your firewall? Probably not the best option though.

 

Spoiler: Firefox 94.0.1 ROP

Mitigation ROP
Timestamp 2021-11-21T09:30:09

Platform 10.0.19044/x64 v921 06_25
PID 14488
Feature 007D1A345FBFB0B6
Application C:\Program Files\Mozilla Firefox\firefox.exe
Created 2021-11-06T21:18:19
Description Firefox 94.0.1

Callee Type LoadLibrary
C:\Program Files (x86)\0patch\Agent\0patchLoaderX64.dll
0x00007FF80605A000 (22 bytes)

Stack Trace
# Address Module Location
-- ---------------- ------------------------ ----------------------------------------
1 00007FF8083904B6 (anonymous)

2 00007FF8082AC1E8 ntdll.dll
a0c51908f87f000020 MOV AL, [0x2000007ff80819c5]
c3 RET


Loaded Modules (31)
-----------------------------------------------------------------------------
00007FF649D60000-00007FF649DF9000 firefox.exe (Mozilla Corporation),
version: 94.0.1
00007FF808190000-00007FF808385000 ntdll.dll (Microsoft Corporation),
version: 10.0.19041.1288 (WinBuild.160101.0800)
00007FF8079D0000-00007FF807A8E000 KERNEL32.dll (Microsoft Corporation),
version: 10.0.19041.1348 (WinBuild.160101.0800)
00007FF8056D0000-00007FF8057E6000 hmpalert.dll (SurfRight B.V.),
version: 3.8.18.921
00007FF805D90000-00007FF806058000 KERNELBASE.dll (Microsoft Corporation),
version: 10.0.19041.1348 (WinBuild.160101.0800)
000000005C070000-000000005C39A000 IPSEng64.dll (Broadcom),
version: 17.2.6.25
00007FF8061E0000-00007FF80628C000 ADVAPI32.dll (Microsoft Corporation),
version: 10.0.19041.1052 (WinBuild.160101.0800)
00007FF806B60000-00007FF806BFE000 msvcrt.dll (Microsoft Corporation),
version: 7.0.19041.546 (WinBuild.160101.0800)
00007FF806690000-00007FF80672B000 sechost.dll (Microsoft Corporation),
version: 10.0.19041.906 (WinBuild.160101.0800)
00007FF806450000-00007FF80657A000 RPCRT4.dll (Microsoft Corporation),
version: 10.0.19041.1288 (WinBuild.160101.0800)
00007FF8068D0000-00007FF8068D8000 PSAPI.DLL (Microsoft Corporation),
version: 10.0.19041.546 (WinBuild.160101.0800)
00007FF8060E0000-00007FF8061E0000 ucrtbase.dll (Microsoft Corporation),
version: 10.0.19041.789 (WinBuild.160101.0800)
00007FFFB8B20000-00007FFFB8BB5000 mozglue.dll (Mozilla Foundation),
version: 94.0.1
00007FF805A60000-00007FF805BB6000 CRYPT32.dll (Microsoft Corporation),
version: 10.0.19041.1320 (WinBuild.160101.0800)
00007FF805D30000-00007FF805D90000 WINTRUST.dll (Microsoft Corporation),
version: 10.0.19041.1266 (WinBuild.160101.0800)
00007FFFEF900000-00007FFFEF991000 MSVCP140.dll (Microsoft Corporation),
version: 14.27.29112.0 built by: vcwrkspc
00007FFFF00F0000-00007FFFF0109000 VCRUNTIME140.dll (Microsoft Corporation),
version: 14.27.29112.0 built by: vcwrkspc
00007FF8052E0000-00007FF8054C4000 dbghelp.dll (Microsoft Corporation),
version: 10.0.19041.867 (WinBuild.160101.0800)
00007FF8054E0000-00007FF8054EA000 VERSION.dll (Microsoft Corporation),
version: 10.0.19041.546 (WinBuild.160101.0800)
00007FFFF05E0000-00007FFFF05EC000 VCRUNTIME140_1.dll (Microsoft Corporation),
version: 14.27.29112.0 built by: vcwrkspc
00007FF804ED0000-00007FF804EDC000 CRYPTBASE.DLL (Microsoft Corporation),
version: 10.0.19041.546 (WinBuild.160101.0800)
00007FF804FD0000-00007FF804FE2000 MSASN1.dll (Microsoft Corporation),
version: 10.0.19041.546 (WinBuild.160101.0800)
00007FF8055A0000-00007FF805660000 0patchLoaderX64.dll (Acros Security),
version: 21.05.05.10500
00007FF807A90000-00007FF807C31000 USER32.dll (Microsoft Corporation),
version: 10.0.19041.1202 (WinBuild.160101.0800)
00007FF805C50000-00007FF805C72000 win32u.dll (Microsoft Corporation),
version: 10.0.19041.1320 (WinBuild.160101.0800)
00007FF8068A0000-00007FF8068CB000 GDI32.dll (Microsoft Corporation),
version: 10.0.19041.1202 (WinBuild.160101.0800)
00007FF8058B0000-00007FF8059BB000 gdi32full.dll (Microsoft Corporation),
version: 10.0.19041.1110 (WinBuild.160101.0800)
00007FF8059C0000-00007FF805A5D000 msvcp_win.dll (Microsoft Corporation),
version: 10.0.19041.789 (WinBuild.160101.0800)
00007FF805270000-00007FF80529C000 dbgcore.DLL (Microsoft Corporation),
version: 10.0.19041.789 (WinBuild.160101.0800)
00007FF806730000-00007FF806760000 IMM32.DLL (Microsoft Corporation),
version: 10.0.19041.546 (WinBuild.160101.0800)
00007FF805200000-00007FF805233000 ntmarta.dll (Microsoft Corporation),
version: 10.0.19041.546 (WinBuild.160101.0800)

Code Injection
000001A8AA608000-000001A8AA609000 4KB C:\Program Files\Mozilla Firefox\firefox.exe [8188]
00007FF80822D000-00007FF80822E000 4KB
00007FF80822F000-00007FF808230000 4KB
00007FF80822C000-00007FF80822D000 4KB
0000000000590000-0000000000591000 4KB

Process Trace
1 C:\Program Files\Mozilla Firefox\firefox.exe [14488]
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="8188.31.1567544857\139779501" -childID 11 -isForBrowser -prefsHandle 10332 -prefMapHandle 10336 -prefsLen 8107 -prefMapSize 271176 -jsInit 1752 278680 -parentBuildID 20211103134640 -app
2 C:\Program Files\Mozilla Firefox\firefox.exe [8188]

Dropped Files
1 C:\Users\Dave\AppData\Roaming\Mozilla\Firefox\Profiles\335r9c8v.default\storage\permanent\moz-extension+++5212798f-38d3-4bdc-9c92-94f9476a8bc3\idb\2325712684IbDdB-FBiDl-eesgSatro.sqlite-wal
Dropped by \Device\HarddiskVolume2\Program Files\Mozilla Firefox\firefox.exe [8188]
Read by \Device\HarddiskVolume2\Program Files\Mozilla Firefox\firefox.exe [8188]
2 C:\Users\Dave\AppData\Roaming\Mozilla\Firefox\Profiles\335r9c8v.default\storage\permanent\moz-extension+++5212798f-38d3-4bdc-9c92-94f9476a8bc3\idb\2325712684IbDdB-FBiDl-eesgSatro.sqlite-shm
Dropped by \Device\HarddiskVolume2\Program Files\Mozilla Firefox\firefox.exe [8188]
3 C:\Users\Dave\AppData\Roaming\Mozilla\Firefox\Profiles\335r9c8v.default\storage\permanent\moz-extension+++5212798f-38d3-4bdc-9c92-94f9476a8bc3\idb\2325712684IbDdB-FBiDl-eesgSatro.files\journals\2419
Dropped by \Device\HarddiskVolume2\Program Files\Mozilla Firefox\firefox.exe [8188]
4 C:\Users\Dave\AppData\Roaming\Mozilla\Firefox\Profiles\335r9c8v.default\storage\permanent\moz-extension+++5212798f-38d3-4bdc-9c92-94f9476a8bc3\idb\2325712684IbDdB-FBiDl-eesgSatro.files\2419
Dropped by \Device\HarddiskVolume2\Program Files\Mozilla Firefox\firefox.exe [8188]
Read by \Device\HarddiskVolume2\Program Files\Mozilla Firefox\firefox.exe [8188]
5 C:\Users\Dave\AppData\Roaming\Mozilla\Firefox\Profiles\335r9c8v.default\sessionstore-backups\recovery.jsonlz4.tmp
Dropped by \Device\HarddiskVolume2\Program Files\Mozilla Firefox\firefox.exe [8188]
6 C:\Users\Dave\AppData\Roaming\Mozilla\Firefox\Profiles\335r9c8v.default\storage\permanent\moz-extension+++5212798f-38d3-4bdc-9c92-94f9476a8bc3\idb\2325712684IbDdB-FBiDl-eesgSatro.files\journals\2418
Dropped by \Device\HarddiskVolume2\Program Files\Mozilla Firefox\firefox.exe [8188]
7 C:\Users\Dave\AppData\Roaming\Mozilla\Firefox\Profiles\335r9c8v.default\storage\permanent\moz-extension+++5212798f-38d3-4bdc-9c92-94f9476a8bc3\idb\2325712684IbDdB-FBiDl-eesgSatro.files\journals\2420
Dropped by \Device\HarddiskVolume2\Program Files\Mozilla Firefox\firefox.exe [8188]
8 C:\Users\Dave\AppData\Roaming\Mozilla\Firefox\Profiles\335r9c8v.default\storage\permanent\moz-extension+++5212798f-38d3-4bdc-9c92-94f9476a8bc3\idb\2325712684IbDdB-FBiDl-eesgSatro.files\2420
Dropped by \Device\HarddiskVolume2\Program Files\Mozilla Firefox\firefox.exe [8188]
Read by \Device\HarddiskVolume2\Program Files\Mozilla Firefox\firefox.exe [8188]
9 C:\Users\Dave\AppData\Roaming\Mozilla\Firefox\Profiles\335r9c8v.default\storage\permanent\moz-extension+++5212798f-38d3-4bdc-9c92-94f9476a8bc3\idb\2325712684IbDdB-FBiDl-eesgSatro.files\journals\2417
Dropped by \Device\HarddiskVolume2\Program Files\Mozilla Firefox\firefox.exe [8188]
10 C:\Users\Dave\AppData\Roaming\Mozilla\Firefox\Profiles\335r9c8v.default\storage\permanent\moz-extension+++5212798f-38d3-4bdc-9c92-94f9476a8bc3\idb\2325712684IbDdB-FBiDl-eesgSatro.files\journals\2421
Dropped by \Device\HarddiskVolume2\Program Files\Mozilla Firefox\firefox.exe [8188]
11 C:\Users\Dave\AppData\Roaming\Mozilla\Firefox\Profiles\335r9c8v.default\storage\permanent\moz-extension+++5212798f-38d3-4bdc-9c92-94f9476a8bc3\idb\2325712684IbDdB-FBiDl-eesgSatro.files\2421
Dropped by \Device\HarddiskVolume2\Program Files\Mozilla Firefox\firefox.exe [8188]
Read by \Device\HarddiskVolume2\Program Files\Mozilla Firefox\firefox.exe [8188]
12 C:\Users\Dave\AppData\Roaming\Mozilla\Firefox\Profiles\335r9c8v.default\storage\permanent\moz-extension+++5212798f-38d3-4bdc-9c92-94f9476a8bc3\idb\2325712684IbDdB-FBiDl-eesgSatro.files\journals\2416
Dropped by \Device\HarddiskVolume2\Program Files\Mozilla Firefox\firefox.exe [8188]
13 C:\Users\Dave\AppData\Roaming\Mozilla\Firefox\Profiles\335r9c8v.default\storage\default\moz-extension+++5212798f-38d3-4bdc-9c92-94f9476a8bc3^userContextId=4294967295\idb\3647222921wleabcEoxlt-eengsairo.sqlite-shm
Dropped by \Device\HarddiskVolume2\Program Files\Mozilla Firefox\firefox.exe [8188]
14 C:\Users\Dave\AppData\Roaming\Mozilla\Firefox\Profiles\335r9c8v.default\storage\default\moz-extension+++5212798f-38d3-4bdc-9c92-94f9476a8bc3\idb\1832725215cbaDcdhe.sqlite-shm
Dropped by \Device\HarddiskVolume2\Program Files\Mozilla Firefox\firefox.exe [8188]
15 C:\Users\Dave\AppData\Roaming\Mozilla\Firefox\Profiles\335r9c8v.default\storage\default\moz-extension+++5212798f-38d3-4bdc-9c92-94f9476a8bc3\idb\1832725215cbaDcdhe.sqlite-wal
Dropped by \Device\HarddiskVolume2\Program Files\Mozilla Firefox\firefox.exe [8188]
16 C:\Users\Dave\AppData\Roaming\Mozilla\Firefox\Profiles\335r9c8v.default\storage\default\moz-extension+++5212798f-38d3-4bdc-9c92-94f9476a8bc3^userContextId=4294967295\idb\3647222921wleabcEoxlt-eengsairo.sqlite-wal
Dropped by \Device\HarddiskVolume2\Program Files\Mozilla Firefox\firefox.exe [8188]
17 C:\Users\Dave\AppData\Roaming\Mozilla\Firefox\Profiles\335r9c8v.default\storage\default\moz-extension+++5212798f-38d3-4bdc-9c92-94f9476a8bc3\idb\1832725215cbaDcdhe.files\journals\1313
Dropped by \Device\HarddiskVolume2\Program Files\Mozilla Firefox\firefox.exe [8188]
18 C:\Users\Dave\AppData\Roaming\Mozilla\Firefox\Profiles\335r9c8v.default\storage\default\moz-extension+++5212798f-38d3-4bdc-9c92-94f9476a8bc3\idb\1832725215cbaDcdhe.files\1313
Dropped by \Device\HarddiskVolume2\Program Files\Mozilla Firefox\firefox.exe [8188]
19 C:\Users\Dave\AppData\Roaming\Mozilla\Firefox\Profiles\335r9c8v.default\storage\default\moz-extension+++5212798f-38d3-4bdc-9c92-94f9476a8bc3\idb\1832725215cbaDcdhe.files\journals\1314
Dropped by \Device\HarddiskVolume2\Program Files\Mozilla Firefox\firefox.exe [8188]
20 C:\Users\Dave\AppData\Roaming\Mozilla\Firefox\Profiles\335r9c8v.default\storage\default\moz-extension+++5212798f-38d3-4bdc-9c92-94f9476a8bc3\idb\1832725215cbaDcdhe.files\1314
Dropped by \Device\HarddiskVolume2\Program Files\Mozilla Firefox\firefox.exe [8188]
21 C:\Users\Dave\AppData\Roaming\Mozilla\Firefox\Profiles\335r9c8v.default\storage\default\moz-extension+++5212798f-38d3-4bdc-9c92-94f9476a8bc3\idb\1832725215cbaDcdhe.files\journals\1315
Dropped by \Device\HarddiskVolume2\Program Files\Mozilla Firefox\firefox.exe [8188]
22 C:\Users\Dave\AppData\Roaming\Mozilla\Firefox\Profiles\335r9c8v.default\storage\default\moz-extension+++5212798f-38d3-4bdc-9c92-94f9476a8bc3\idb\1832725215cbaDcdhe.files\1315
Dropped by \Device\HarddiskVolume2\Program Files\Mozilla Firefox\firefox.exe [8188]
23 C:\Users\Dave\AppData\Roaming\Mozilla\Firefox\Profiles\335r9c8v.default\storage\default\moz-extension+++5212798f-38d3-4bdc-9c92-94f9476a8bc3\idb\1832725215cbaDcdhe.files\journals\1316
Dropped by \Device\HarddiskVolume2\Program Files\Mozilla Firefox\firefox.exe [8188]
24 C:\Users\Dave\AppData\Roaming\Mozilla\Firefox\Profiles\335r9c8v.default\storage\default\moz-extension+++5212798f-38d3-4bdc-9c92-94f9476a8bc3\idb\1832725215cbaDcdhe.files\1316
Dropped by \Device\HarddiskVolume2\Program Files\Mozilla Firefox\firefox.exe [8188]
25 C:\Users\Dave\AppData\Roaming\Mozilla\Firefox\Profiles\335r9c8v.default\storage\default\moz-extension+++5212798f-38d3-4bdc-9c92-94f9476a8bc3\idb\1832725215cbaDcdhe.files\journals\1311
Dropped by \Device\HarddiskVolume2\Program Files\Mozilla Firefox\firefox.exe [8188]
26 C:\Users\Dave\AppData\Roaming\Mozilla\Firefox\Profiles\335r9c8v.default\storage\default\moz-extension+++5212798f-38d3-4bdc-9c92-94f9476a8bc3\idb\1832725215cbaDcdhe.files\journals\1309
Dropped by \Device\HarddiskVolume2\Program Files\Mozilla Firefox\firefox.exe [8188]
27 C:\Users\Dave\AppData\Roaming\Mozilla\Firefox\Profiles\335r9c8v.default\storage\default\moz-extension+++5212798f-38d3-4bdc-9c92-94f9476a8bc3\idb\1832725215cbaDcdhe.files\journals\1312
Dropped by \Device\HarddiskVolume2\Program Files\Mozilla Firefox\firefox.exe [8188]
28 C:\Users\Dave\AppData\Roaming\Mozilla\Firefox\Profiles\335r9c8v.default\storage\default\moz-extension+++5212798f-38d3-4bdc-9c92-94f9476a8bc3\idb\1832725215cbaDcdhe.files\journals\1310
Dropped by \Device\HarddiskVolume2\Program Files\Mozilla Firefox\firefox.exe [8188]

Thumbprints
N/A

 

I've uninstalled 0Patch as it has caused a few issues lately, both with HMP.A and WVSX with little to know benefit.

 

TY for your responses, Krusty. I decided long ago that if a security program was complaining about Sandboxie, I would ultimately stay with Sandboxie and remove the complaining party.

 

Same here.

 

Yeah HMP.A also gets rules from the cloud so that isn't smart.
This is the registry key to turn off the auto-update:
https://www.wilderssecurity.com/thr...iscussion-thread.324841/page-612#post-2806646

 

Great! Thanks for posting that link.

@Page42 !

 

Indeed. Gonna do that right now.

 

TY, BoerenkoolMetWorst.