Sophos Exploit Prevention
Release notes
About these release notes
These are the release notes for Sophos Exploit Prevention managed by Sophos Enterprise Console. Exploit Prevention is available alongside Sophos Endpoint Security and Control for Windows if you have the appropriate license. It provides protection against ransomware, protects critical functions in web browsers,and protects the applications most vulnerable to exploitation by malware among other forms of exploitation attacks.
Components
| Sophos Exploit Prevention | 3.7.15January 2020 | 3.7.13.1460August 2019 | 3.7.12.508April 2019 | 3.7.10.768February 2019 | 3.7.6.755August 2018 | 3.7.6May 2018 |
| HitManPro.Alert | 3.7.15.446 | 3.7.13.1460 | 3.7.12.508 | 3.7.10.768 | 3.7.6.755 | 3.7.6.755 |
| SophosClean | 3.7.21 | 3.7.21 | 3.7.21 | 3.7.21 | 3.7.21 | 3.7.21 |
Version 3.7.15
HitmanPro.Alert has been updated to 3.7.15.446.
Resolved issues
| Issue ID | Component | Description |
|---|---|---|
| WINEP-21933 | HitmanPro.Alert | Resolved an issue in which the thumbprint required to allow a lockdown alert is changed every time the application is run. |
| WINEP_20880 | HitmanPro.Alert | Resolved an issue in which CryptoGuard detects an attack when EPS files are copied to a file server share. |
| WINEP-20812 | HitmanPro.Alert | Resolved an issue that caused laptops to occasionally stop when docked. |
| WINEP-20759 | HitmanPro.Alert | Resolved an issue in which the HitmanPro.Alert service crashes after updating to 3.7.13.1337. |
| WINEP-20438 | HitmanPro.Alert | Resolved an issue in which CryptoGuard is triggered on a file server because of actions being performed on endpoints using an application called AdvantX. |
| WINEP-20356 | HitmanPro.Alert | Resolved an issue in which Import Address Table Access Filtering exploit detections are triggered against Microsoft Office applications, as well as Adobe Acrobat and nschill.exe. |
| WINEP-19843 | HitmanPro.Alert | Resolved an issue in which two different lockdown detections happen at the same time. |
| WINEP-19818 | HitmanPro.Alert | Resolved an issue in which, with CryptoGuard turned on, the PAEXEC application fails to load. |
| WINEP-19765 | HitmanPro.Alert | Resolved an issue in which HitmanPro.Alert caused the operating system to stop unexpectedly on a server. |
| WINEP-19707 | HitmanPro.Alert | Resolved an issue in which a ZENworks virtual application fails to open. |
| WINEP-19647 | HitmanPro.Alert | Resolved an issue in which a lockdown is detected on Foxit Reader when attempting to open it. |
| WINEP-19378 | HitmanPro.Alert | Resolved an issue in which Cygwin commands fail. |
| WINEP-19359 | HitmanPro.Alert | Resolved an issue in which SecureCS is detected as ransomware. |
| WINEP-19351 | HitmanPro.Alert | Resolved an issue in which a CryptoGuard detection occurs in an internal application: FIS Direct Branch or COCC. |
| WINEP-19174 | HitmanPro.Alert | Resolved an issue in which a CryptoGuard detection occurs at remote IP addresses when files are saved to a shared files server. |
| WINEP-19100 | HitmanPro.Alert | Resolved an issue in which Directory Opus 12 triggers a CryptoGuard remote ransomware detection. |
| WINEP-17943 | HitmanPro.Alert | Resolved an issue in which Digital Guardian DLP causes an intruder detection to be reported while the user is browsing in Microsoft Edge. |
Version 3.7.13.1460
HitmanPro.Alert has been updated to 3.7.13.1460.
Resolved issues
| Issue ID | Component | Description |
|---|---|---|
| WINEP-16237 | HitmanPro.Alert | Resolved an issue that prevents a secure email gateway processing emails. |
| WINEP-16354 | HitmanPro.Alert | Resolved an issue in which the CryptoGuard folder is not emptied correctly on a file server. |
| WINEP-17173 | HitmanPro.Alert | Resolved an issue with ROP detection in Microsoft Excel encrypted documents. |
| WINEP-17347 | HitmanPro.Alert | Resolved an issue in which DNS resolution fails. |
| WINEP-17406 | HitmanPro.Alert | Resolved an issue in which AppSense fails to be installed. |
| WINEP-17454 | HitmanPro.Alert | Resolved an issue concerning a Caller Check exception in Internet Explorer 11. |
| WINEP-17842 | HitmanPro.Alert | Resolved an issue in which CryptoGuard detects an attack in RoboCopy when it is copying files. |
| WINEP-18105 | HitmanPro.Alert | Resolved an issue in which CryptoGuard slows down the digital file signature checking process. |
| WINEP-18169 | HitmanPro.Alert | Resolved an issue concerning false CryptoGuard detections when Microsoft Word documents are created remotely. |
| WINEP-18181 | HitmanPro.Alert | Resolved an issue with CryptoGuard checking excluded processes. |
| WINEP-18292 | HitmanPro.Alert | Resolved an issue concerning a Caller Check exception in Microsoft Outlook. |
| WINEP-18353 | HitmanPro.Alert | Improved CryptoGuard’s performance with excluded files. |
| WINEP-18520 | HitmanPro.Alert | Resolved an issue with running secure apps in Mozilla Firefox. |
| WINEP-18583 | HitmanPro.Alert | Resolved an issue concerning a Caller Check exception in macro-enabled Microsoft Excel files. |
| WINEP-18667 | HitmanPro.Alert | Resolved an issue in which HitmanPro.Alert upgrades cause servers to stop. |
| WINEP-18722 | HitmanPro.Alert | Resolved an issue in which HitmanPro.Alert fails to add files as exceptions. |
| WINEP-18783 | HitmanPro.Alert | Resolved performance issues with HitmanPro.Alert. |
| WINEP-18873 | HitmanPro.Alert | Resolved an issue in which HitmanPro.Alert prevents encrypted remote sessions from starting. |
| WINEP-18893 | HitmanPro.Alert | Resolved an issue in which HitmanPro.Alert causes computers that are running Windows 10 (version 1803) to stop. |
| WINEP-18915 | HitmanPro.Alert | Resolved an issue concerning false CryptoGuard detections when encrypting files. |
| WINEP-19078 | HitmanPro.Alert | Resolved an issue concerning false CryptoGuard detections when encrypting files remotely with SafeGuard File Encryption 8.10.2. |
| WINEP-19179 | HitmanPro.Alert | Resolved an issue concerning false CryptoGuard detections when encrypting files remotely with etfile. |
| WINEP-19282, WINEP-17047 | HitmanPro.Alert | Resolved issues concerning Caller Check exceptions in games. |
| WINEP-19792 | HitmanPro.Alert | Resolved an issue in which HitmanPro.Alert causes Windows Server 2008 R2 servers to stop. |
| WINEP-15961 | HitmanPro.Alert | Resolved an issue with saving Microsoft Office files to a network share when CryptoGuard is installed. |
| WINEP-16679 | HitmanPro.Alert | Resolved an issue concerning false CryptoGuard detections when Safeguard File Encryption is installed. |
| WINEP-17244 | HitmanPro.Alert | Resolved memory issues on Windows 2012 servers. |
| WINEP-15669 | HitmanPro.Alert | Resolved an issue in which Microsoft Application Verifier protected apps do not start. |
| WINEP-15791 | HitmanPro.Alert | Resolved an issue with running the Microsoft Office NetDocuments plugin in Internet Explorer 11. |
| WINEP-15954 | HitmanPro.Alert | Resolved an issue concerning false Data Execution Prevention (DEP) detections when creating PDF files in Adobe Acrobat 2017. |
| WINEP-16207 | HitmanPro.Alert | Resolved an issue with reading ebooks in Internet Explorer 11. |
| WINEP-16564 | HitmanPro.Alert | Resolved an issue in which vswhere.exe does not run (first time) when CryptoGuard is turned on. |
| WINEP-16763 | HitmanPro.Alert | Resolved an issue concerning false hollow process detections when using an open source office suite and eye-tracking software. |
| WINEP-16974 | HitmanPro.Alert | Resolved an issue with detections in auditing software. |
| WINEP-17393 | HitmanPro.Alert | Resolved an issue with APC alert reporting. |
| WINEP-17439 | HitmanPro.Alert | Resolved an issue concerning false hollow process detections in Microsoft Visual Studio 2017. |
| WINEP-16914 | HitmanPro.Alert | Resolved an issue concerning CryptoGuard detections in PDF files. |
Version 3.7.12.508
HitmanPro.Alert has been updated to 3.7.12.508.
Resolved issues
| Issue ID | Component | Description |
|---|---|---|
| WINEP-7929 | HitmanPro.Alert | Resolved an issue with starting Skype automatically. |
| WINEP-13549 | HitmanPro.Alert | Resolved an issue with ROP alerts in Microsoft Office 2016. |
| WINEP-14044 | HitmanPro.Alert | Resolved an issue with ROP alerts in Microsoft Excel. |
| WINEP-14080 | HitmanPro.Alert | Resolved an issue with Cygwin commands failing. |
| WINEP-14369 | HitmanPro.Alert | Resolved an issue with detections in Cygwin. |
| WINEP-14482 | HitmanPro.Alert | Resolved an issue when opening PDF files. |
| WINEP-14507 | HitmanPro.Alert | Resolved an issue with some websites being slow to open. |
| WINEP-14696 | HitmanPro.Alert | Resolved an issue with caller check detections. |
| WINEP-14789 | HitmanPro.Alert | Resolved an issue with caller check detections in 1password. |
| WINEP-15400 | HitmanPro.Alert | Resolved issues with Windows 10 failing to start. |
| WINEP-15531 | HitmanPro.Alert | Resolved an issue with starting SiteKiosk. |
| WINEP-15539 | HitmanPro.Alert | Resolved an issue with CryptoGuard detections in Explorer. |
| WINEP-15651 | HitmanPro.Alert | Resolved issues with disk access when running HitmanPro.Alert . |
| WINEP-15779 | HitmanPro.Alert | Resolved an issue with CrypoGuard detections in Windows Media Player. |
| WINEP-15828 | HitmanPro.Alert | Resolved an issue with remote detections when creating PDF files. |
| WINEP-16310 | HitmanPro.Alert | Resolved an issue with false Wipeguard detections when using Symantec PGP Encryption. |
| WINEP-16404 | HitmanPro.Alert | Resolved an IAT alert in Internet Explorer 11. |
| WINEP-16512 | HitmanPro.Alert | Resolved an issue with Internet Explorer failing when Intercept X and SofTrack are installed. |
| WINEP-18667 | HitmanPro.Alert | Resolved an issue with servers stopping when HitmanPro.Alert is upgraded. |
| WINEP-18783 | HitmanPro.Alert | Resolved a conflict with the Intel MPX Runtime driver that caused performance issues. |
Version 3.7.10.768
HitmanPro.Alert has been updated to 3.7.10.768.
Resolved issues
| Issue ID | Component | Description |
|---|---|---|
| WINEP-16464 | HitmanPro.Alert | Resolved an issue with ROP alerts in Microsoft Office 2013. |
| WINEP-16202 | HitmanPro.Alert | Resolved an issue with ROP alerts when streaming internet media. |
| WINEP-15695 | HitmanPro.Alert | Resolved an issue with IP detection in a publishing application. |
| WINEP-14950 | HitmanPro.Alert | Resolved an issue with ROP detection in Microsoft Word. |
| WINEP-14858 | HitmanPro.Alert | Resolved an issue with ROP detections in several applications. |
| WINEP-14833 | HitmanPro.Alert | Resolved an issue with increased ROP detections in Chrome 67 and later. |
| WINEP-14590 | HitmanPro.Alert | Resolved an issue with intruder detection in Chrome and Internet Explorer with LanDesk installed. |
| WINEP-14505 | HitmanPro.Alert | Resolved an issue with lockdown detections in PDF files. |
| WINEP-14442 | HitmanPro.Alert | Resolved an issue with caller check detections in Microsoft Outlook plugins. |
| WINEP-14253 | HitmanPro.Alert | Resolved an issue with HitmanPro.Alert causing Windows to stop. |
| WINEP-14139 | HitmanPro.Alert | Resolved an issue with Skype stopping during calls. |
| WINEP-13578 | HitmanPro.Alert | Resolved an issue with CryptoGuard detections in Lotus Notes. |
| WINEP-13460 | HitmanPro.Alert | Resolved an issue with Windows 7 machines not shutting down properly. |
| WINEP-13454 | HitmanPro.Alert | Resolved an issue with LoadLib in Firefox. |
| WINEP-13338 | HitmanPro.Alert | Resolved an issue with Wipeguard protection not working on Hyper-V virtual systems. |
| WINEP-13238 | HitmanPro.Alert | Resolved an issue with caller check detections in Microsoft Excel. |
| WINEP-13230 | HitmanPro.Alert | Resolved an issue with Windows 7 stopping when running Intercept X and Symantec Endpoint 14.0.3897.1101. |
| WINEP-13209 | HitmanPro.Alert | Resolved an issue with ROP detections in Microsoft Excel. |
| WINEP-13164 | HitmanPro.Alert | Resolved an issue with CryptoGuard detections in AppLife Update. |
| WINEP-13162 | HitmanPro.Alert | Resolved an issue with a false detection in Digital Guardian. |
| WINEP-12989 | HitmanPro.Alert | Resolved an issue with Windows stopping due to HitmanPro.Alert and DeviceLock drivers clashing. |
| WINEP-12932 | HitmanPro.Alert | Resolved a lockdown detection in Internet Explorer. |
| WINEP-12840 | HitmanPro.Alert | Resolved Data Execution Prevention issues in Internet Explorer. |
| WINEP-12735 | HitmanPro.Alert | Resolved an IAF alert for Microsoft Outlook. |
| WINEP-11473 | HitmanPro.Alert | Resolved an issue with Windows error dumps for HitmanPro.Alert being created daily. |
Version 3.7.6.755
Security improvements.
Updated components
HitManPro.Alert has been updated to 3.7.6.755.
Version 3.7.6
Updated components
HitManPro.Alert has been updated to 3.7.6.
Resolved issues
| Issue ID | Component | Description |
|---|---|---|
| WINEP-13294 | HitmanPro.Alert | Resolved endpoint performance issues. |
| WINEP-13238 | HitmanPro.Alert | Resolved an issue with Microsoft Excel when running the “UnionSquare” plugin. |
| WINEP-12842 | HitmanPro.Alert | Resolved an issue with Microsoft Powerpoint 2016. |
| WINEP-12826 | HitmanPro.Alert | Resolved issues with driver verification. |
| WINEP-12686 | HitmanPro.Alert | Resolved an issue with java applications not launching in Internet Explorer. |
| WINEP-12670 | HitmanPro.Alert | Resolved an issue with program starts being delayed. |
| WINEP-12635 | HitmanPro.Alert | Resolved issues with machines stopping and failing to complete shutdown. |
| WINEP-12588 | HitmanPro.Alert | Resolved issues with opening web applications in Internet Explorer. |
| WINEP-12407 | HitmanPro.Alert | Resolved an issue with Internet Explorer stopping repeatedly. |
| WINEP-12367 | HitmanPro.Alert | Resolved issues with running VBScripts in Microsoft Excel. |
| WINEP-12301 | HitmanPro.Alert | Resolved an issue with detections in Microsoft Outlook. |
| WINEP-12299 | HitmanPro.Alert | Resolved an issue with VitreaCore “vims” radiology application not opening. |
| WINEP-12278 | HitmanPro.Alert | Resolved an issue with servers stopping when running CryptoGuard. |
| WINEP-12275 | HitmanPro.Alert | Resolved an issue with MitreFinch TMS not opening. |
| WINEP-12160 | HitmanPro.Alert | Resolved an issue with CCTV software ABUS VMSEnterprise failing to start. |
| WINEP-11977 | HitmanPro.Alert | Resolved an issue with detections in the XCargo Microsoft Excel plugin. |
| WINEP-11959 | HitmanPro.Alert | Resolved issues with Freedom Scientific software. |
| WINEP-11880 | HitmanPro.Alert | Resolved an issue with mitigations after they have been turned off in a policy. |
| WINEP-11514 | HitmanPro.Alert | Resolved an issue with opening Acrobat Reader. |
| WINEP-11319 | HitmanPro.Alert | Resolved an issue with Intercept X and Symantec AV causing Internet Explorer 11 to stop. |
| WINEP-11296 | HitmanPro.Alert | Resolved an issue with intruder detections in Internet Explorer and Firefox. |
| WINEP-10920 | HitmanPro.Alert | Resolved an issue with CryptoGuard affecting the load time of Zorgdossier. |
| WINEP-10876 | HitmanPro.Alert | Resolved an issue with servers stopping serving files when CryptoGuard is installed. |
| WINEP-10741 | HitmanPro.Alert | Resolved an issue with lockdown detection on Bomgar support client. |
| WINEP-10363 | HitmanPro.Alert | Resolved an issue with VBScript GodMode in Internet Explorer. |
| WINEP-10059 | HitmanPro.Alert | Resolved an issue with detections in games. |
| WINEP-8871 | HitmanPro.Alert | Resolved issues with Internet Explorer creating unusable pages. |
| WINEP-10060 | HitmanPro.Alert | Resolved an issue when opening PDF files. |
| WINEP-8325 | HitmanPro.Alert | Resolved an issue with McAfee and Intercept X. |
| Issue ID | Component | Description |
|---|---|---|
| WINEP-7737 | Exploit Prevention | Exploit Prevention reports errors on upgrade if the endpoint has a pending reboot. You will need to reboot the machine twice to resolve the issue. |
| WINEP-7523 | HitManPro.Alert | The HitManPro.Alert plug-in fails to initialize if Exploit Prevention disabled is on startup. |
You can find technical support for Sophos products in any of these ways:
- Visit the Sophos Community at community.sophos.com/ and search for other users who are experiencing the same problem.
- Visit the Sophos support knowledge base at www.sophos.com/en-us/support.aspx.
- Download the product documentation at www.sophos.com/en-us/support/documentation.aspx.
- Open a ticket with our support team at https://secure2.sophos.com/support/contact-support/support-query.aspx.
Copyright © 2020 Sophos Limited. All rights reserved. No part of this publication may be reproduced, stored in a retrieval system, or transmitted, in any form or by any means, electronic, mechanical, photocopying, recording or otherwise unless you are either a valid licensee where the documentation can be reproduced in accordance with the license terms or you otherwise have the prior permission in writing of the copyright owner.
Sophos and Sophos Anti-Virus are registered trademarks of Sophos Limited and Sophos Group. All other product and company names mentioned are trademarks or registered trademarks of their respective owners.
