HitmanPro.Alert - wersje rozwojowe

Changelog

Fixed BSOD caused by WipeGuard. Some Windows 10 systems may have encountered this issue when removing a USB flash drive.
Fixed WipeGuard false positive when creating HitmanPro.Kickstart USB flash drive.
Improved CallerCheck mitigation
Added hardware-assisted support for Intel Goldmont and Kaby Lake

Kliknij aby rozwinąć...

Changelog

Added additional mitigations to the thumbprint facility
Fixed ROP detection in Photoshop Elements Editor
Several minor improvements

Notes
This build uses Microsoft co-signed drivers.

Kliknij aby rozwinąć...

Changelog (compared to 580)

Improved installer/uninstaller
Improved compatibility with MBAE, MBAM v3 and EMET
Improved CallerCheck mitigation
Improved DEP mitigation
Improved compatibility with software using delay-loaded user32.dll
Fixed issue with Forza Horizon 3 failing to start
Fixed issue with Enpass UWP failing to start
Fixed rare crash in Mozilla Firefox
Fixed rare crash in conhost.exe
Fixed rare BSOD in WipeGuard in combination with some USB fixed disks
Fixed small memory leak
The issue with Overwatch was fixed by Blizzard

Notes
This build does NOT have Microsoft co-signed drivers. So this build will NOT run on computers with Windows 10 Redstone 1 with SecureBoot enabled.

Kliknij aby rozwinąć...

• Real-time Anti-Malware
  Works with the HitmanPro cloud.
  
  
• Credential Theft Protection
  Preventing theft of authentication passwords and hash information from memory, registry and disk. Prevents Mimikatz-style attacks.
  
  
• Local Privilege Guard
  Prevents exploits of the operating system kernel. Prevents an attacker from using the privilege information of another process.
  
  
• Code Cave mitigation
  Stops backdoors in trusted code.
  
  
• Sticky Keys mitigation
  Prevents misuse of the Microsoft sticky key feature. Usually used by attackers to gain persistence.
  
  
• Asynchronous Procedure Call (APC) mitigation
  Stops code injection via APC (ex. DoublePulsar and Atom Bombing attack).
  
  
• Application Verifier mitigation
  Prevents misuse of the Application Verifier feature of Windows (eg. Double Agent attack).
  
  
• Malicious Process Migration
  Detects remote reflective DLL injection used to move laterally between processes.

• Added DoublePulsar detection to APC mitigation
• Added Compatibility with QEMU/KVM hypervisor
• Improved Anti-Malware component
• Improved CodeCave mitigation
• Improved Local Privilege Guard mitigation
• Improved Asynchronous Procedure Call (APC) mitigation
• Improved DLL injection respects Trustlets
• Improved CryptoGuard 4.9
• Improved Installer
• Fixed CodeCave false positives
• Fixed PrivGuard false positives
• Fixed APCViolation false positives
• Fixed BSOD installing Alert in QEMU/KVM
• Fixed BSOD caused in minifilter (introduced since 701)
• Fixed iTunes compatibility
• Fixed Compatibility with Steam Apps
• Fixed typo in German translation Offene Browser

• Do NOT run this build on production environments. This is BETA software.
• This build has Microsoft co-signed drivers.
• This build triggers a PrivGuard false positives when running Sandboxie sandboxed processes. We are looking into this and aiming to get this fixed as soon as possible.

• Added Sandboxie compatility to Local Privilege Guard (PrivGuard)
• Fixed HitmanPro/Sophos Clean triggering Credential Theft Protection (CredGuard)
• Fixed driver did not properly keep track of injection and whitelisting
• Fixed driver did not properly stop when installing only the anti-ransomware component

This build focuses on improvements on code injection and related fail-safe mechanisms. Additional UI elements for Anti-Malware exclusions are on our roadmap.

Changelog

• Added code injection fail-safe mechanisms
• Improved Anti-Malware performance (changed from on-access to on-execute)
• Improved APC Mitigation
• Improved path translation for thumbprints
• Fixed detection of Protected Processes and Trustlets
• Fixed Local Privilege Guard (PrivGuard) mitigation on Windows XP
• Fixed Windows XP support was broken since build 708

Notes
This build has Microsoft co-signed drivers.

Kliknij aby rozwinąć...

HitmanPro.Alert 3.7 build 712 BETA

We are currently working on integrating a new on-demand scanner into Alert and folder exclusions. In the meantime here is a maintenance build before we can turn this version into a release.

Changelog

• Added Volume Boot Record (VBR) filtering to WipeGuard
• Improved Credential Theft Protection on SAM file
• Fixed WipeGuard LBA length calculation (was too short)
• Fixed WipeGuard detection string could be truncated in some circumstances
• Fixed Excel VBA macro’s trigger DEP mitigation in old Office versions

Release notes
This version has Microsoft co-signed drivers.

Kliknij aby rozwinąć...

HitmanPro.Alert 3.7.0 Build 717 BETA

Finally a big update to the last beta. It contains many improvements and fixes. Here is the changelog.

Changelog

• Improved Redstone 3 compatibility
• Improved Anti-Malware cloud lookup
• Improved CodeCave mitigation
• Improved Credential Theft Protection
• Improved CryptoGuard Anti-Ransomware
• Improved Lockdown mitigation
• Improved ROP mitigation
• Improved DEP mitigation
• Improved LoadLib mitigation
• Improved Authenticode catalog signing handling
• Improved memory usage (lowered)
• Improved compatibility with Forcepoint
• Improved compatibility with QQ Messenger
• Fixed CodeCave detection in executables when McAfee is installed
• Fixed CodeCave detection in Visual Studio 2017 15.3
• Fixed LoadLib detection in Firefox 55.0.3
• Fixed NonPaged memory leak in driver
• Fixed BSOD when minifilter failed to initialize
• Fixed potential BSOD when trying to hash an executable located on the network
• Fixed DLL hijacking vulnerability on Windows 7 machines without KB2533623
• Fixed DEP mitigation triggered in some Microsoft Excel macro's
• Various other minor fixes

Notes
This version has Microsoft co-signed drivers.

Kliknij aby rozwinąć...

Changelog (compared to

Zaloguj lub Zarejestruj się aby zobaczyć!

)

• Improved
  • Compatibility with McAfee (e.g. McAfee Endpoint Security)
  • Credential Theft Protection now also writes an event to the Windows Event Log
  • Code injection of the HitmanPro.Alert Support Library (DLL)
  • Upgrade when running in 'Anti-ransomware only' mode
• Fixed
  • Clean-up of the CryptoGuard backup folder on system shutdown or restart
  • Crash caused by CryptoGuard
  • DLL hijack mitigation which loaded an incorrect DLL on WoW64 processes
  • Intruder alert in Firefox when Norton is installed (e.g. Norton Security)

Kliknij aby rozwinąć...

Changelog (compared to

Zaloguj lub Zarejestruj się aby zobaczyć!

)

• Added automatic protection of Microsoft Outlook (under the Office category) to defend against e.g. DDE attacks embedded in the body of malicious emails or calendar invites. More info here:
  Zaloguj lub Zarejestruj się aby zobaczyć!
• Fixed compatibility issue with certain .NET applications (incl. AdGuard and SimpleDNSCrypt).
• Fixed Application Lockdown which accidentally no longer blocked e.g. malicious PowerShell scripts launched from e.g. Microsoft Word or Internet Explorer. It was broken since beta build 714.

Kliknij aby rozwinąć...

Changelog (compared to

Zaloguj lub Zarejestruj się aby zobaczyć!

)

• Improved Code Cave Mitigation.
• Improved Software Radar so it now also scans 'App path' for browsers. This will put Opera under Browsers instead of Office. It now also detects web browser that allow to be installed by less-privileged normal users.
• Improved VBScript God Mode protection on Windows 10 Creators Update (Redstone 2) and newer.
• Improved Control Flow Integrity (CFI) on Windows 10 64-bit.
• Fixed an incompatibility with an Internet Explorer browser plugin from Agricultural Bank of China.
• Fixed an incompatibility with Internet Explorer browser plugins from South Korean SoftForum XecureWeb.
• Fixed an incompatibility between our APC Mitigation, that thwarts e.g. DoublePulsar and AtomBombing code injection, and Avast / AVG on Windows 10 Fall Creators Update only (Redstone 3). This also only affected specific applications installed by the enduser. Note: Requires a secondary update in our cloud before this fix is completely operational. Please allow us until next week to complete this - no further manual update by enduser needed. Most Avast / AVG user wouldn't have noticed this incompatibility issue.
• Fixed real-time protection against prevalent malware (anti-malware) on Windows XP.
• Fixed a BSOD caused by BadUSB Protection, which could occur on specific hardware coming out of sleep.
• Fixed several other minor issues.

Important notices

1. Before uninstalling the existing 7xx build or upgrading to this build, please disable the Block Untrusted Fonts mitigation (which is default disabled). This because we removed the Block Untrusted Fonts mitigation, which is only available on Windows 10. This mitigation relied on a structure in Windows 10 which is no longer supported by Microsoft. More information:
   Zaloguj lub Zarejestruj się aby zobaczyć!
2. Furthermore, to start fresh, we recommend that you uninstall the existing version of HitmanPro.Alert and that you remove this folder from your machine before rebooting: C:\ProgramData\HitmanPro.Alert
3. Credential Theft Protection is now default disabled. If you'd like to enable it, please do, as it protects against Mimikatz and similar attacks. But remember that if you want to make a full system backup of your Windows, you might need to temporarily disable this protection or your backup software may be unable to backup the Windows SAM database. We'll improve this in a future version.

[/QUOTE]

Zaloguj lub Zarejestruj się aby zobaczyć!

This version includes drivers co-signed by Microsoft and thus also runs on systems with Secure Boot enabled.

Kliknij aby rozwinąć...

Kliknij aby rozwinąć...

Changelog (compared to

Zaloguj lub Zarejestruj się aby zobaczyć!

)

• Added
  • PrivGuard: mitigate MS16-032 (CVE-2016-0099)
  • Application lockdown for Microsoft office Equation Editor (CVE-2017-11882)
• Improved
  • CodeCave, HeapSpray, CryptoGuard, HollowProcess Mitigations
• Fixed
  • BadUSB Alert during boot while BadUSB was disabled
    
  • IAF FP in Nero Media player
  • Windows System Image Backup failing with locked EFI/ESP
    
  • Antimalware won't (stay) enable(d)

Kliknij aby rozwinąć...

HitmanPro.Alert 3.7.3 build 729 Released

Changelog (compared to

Zaloguj lub Zarejestruj się aby zobaczyć!

)

• Added
  • PrivGuard: mitigate MS16-032 (CVE-2016-0099)
  • Application lockdown for Microsoft office Equation Editor (CVE-2017-11882)
• Improved
  • CodeCave, HeapSpray, CryptoGuard, HollowProcess Mitigations
• Fixed
  • BadUSB Alert during boot while BadUSB was disabled
    
  • IAF FP in Nero Media player
  • Windows System Image Backup failing with locked EFI/ESP
    
  • Antimalware won't (stay) enable(d)

Kliknij aby rozwinąć...