HitmanPro.ALERT Support and Discussion Thread

I have 82 files in CryptoGuard folder. Would like to get word from Erik or Mark before deleting. No indication I ever had any ransomware.

 

this particular question has already been answered long ago, anyway if you want to wait for *loman replay...
(sorry for my poor english, G1111)

 

Look for ex at this post:
temporary previous versions that will be resumed if...

So, if you have not been attacked by Ransomware, these temporary files are just garbage (and you could safely delete them if they are not automatically deleted by Alert)...

 

Okay, thanks test.

 

de nada/my pleasure/di nulla (the last one is in my language)

 

Just had to temporarily disable Control Flow Integrity on Word, Excel, Powerpoint for Office 2013 on Win 10 64 bit. This one had Word or Excel crash "Word has experienced a problem and must close". No message from HMPA this time, just office crashing.

 

Not one file here

 

I imagine it must be very frustrating for the guys at HMPA to make a carefully, precisely coded software that blocks exploits in a very targeted way, and then see other coders of prominent software such as MS Office don't care about good standards of coding and testing, and use improper techniques, and just make a mockery of their precious prevention with one simple update. As we say in Dutch, it's "dweilen met de kraan open", mopping the floor while the tap keeps running.

 

Very well said.

 

I got the fly-out advising of an update earlier. I noticed that there were several of these fly-outs, again. Anyway, after reboot I am running version 3.1.9 build 363...

 

I am using a ramdisk program to write all my sandboxed session data to the RAM rather than HD ..

So, could the "Cryptoguard" folder contain any data from my sandboxed sessions ?

Hope not !

Abdullah

 

Just checked mine - 228 files for 58 MB created between 30/12 and two days ago. Win 7 x64.
Evidently, as per others' posts, the auto-delete does not always works

 

Also checked C:\Windows\CryptoGuard from Windows 10 x64.

Found 128 files (178 MB) ranging from 23-Sep-2015 to 23-Mar-2016.

Is it safe to delete them?

 

It looks like more a block that a corner ...

 

Same here.

 

Looks like there's room for an additional app in CCleaner.

 

Ditto. All 12.3GB entries.

 

There already is!!!

1. In CCleaner Free, go to Cleaner>Advanced, then check box "Custom Files and Folders".
2. Go to Options>Include>Add, then select "browse to drive or folder". Select the Cryptoguard folder and click "OK".
3. When you run CCleaner again, you will see any files in the Cryptoguard folder now listed in the "files to be deleted list".
Note: there is an option to only delete files older than 24 hours. May want to consider this just in case you timed poorly to run CCleaner just as Cryptoguard was detecting a real exploit. Not likely, but just saying...

I tested this and it worked fine for me :-D

 

@markloman or @erikloman

Will HitmanPro.ALERT provide protections against exploits using the two new vulnerabilities in the QuickTime player?

For more information see http://blog.trendmicro.com/urgent-call-action-uninstall-quicktime-windows-today/, ZDI-16-241 and ZDI-16-242.

 

I uninstalled QuickTime player yesterday.

Then I went to the Apple site and downloaded these Quicktime sample files (.mov, .mp4, etc.)

https://support.apple.com/en-us/HT201549

As a test I then opened them one at a time in Windows Media player. All opened fine, no errors.

I see no reason to keep abandoned, unsupported software on any computer. It just expands your attack surface. I think that there comes a point where good practice is better than relying completely on defensive shields. The shields are better left for unknown exploits, zero days, etc., or if you accidentally click on something bad.

In this case we have been warned ...

 

HitmanPro.Alert 3.1.9 Build 365 PreRelease

Changelog

• Fixed false positive on Office. This false positive occurs on some machines and was introduced after MS updated Office. In the near future false positives like this will be solved from the cloud so that no program update is needed.

Download
http://test.hitmanpro.com/hmpalert3b365.exe

Please let me know if this update fixes the problem

 

Thanks for the update!
HMP.A will have a cloud! Great! I can't wait!

 

a very good improvement!

Keep up the good work!

 

On win10 installed 65 over 64, restarted, no issues.