Issues with HP Sure Click in Windows 10

[German]Today still a blog post about HP Sure Click, which is shipped by the manufacturer with certain business PCs and should protect Windows 10 systems, but can lead to very unsightly collateral damage.

HP Sure Click, what is that?

Hewlett Packard ships HP Sure Click on some of its Windows 10 machines. This program is designed to protect a Windows computer from malware lurking on malicious websites or in common files.

Instead of trying to detect malware, untrusted websites and files are opened in their own isolated virtual containers known as virtual micromachines (VMs). If malicious code is present, these micro-VMs cause the malware to believe that it is running on your computer even though it is actually trapped.

HP Sure Click isolates critical applications in their own virtual containers – malware is trapped and deleted as soon as you close the application. See this HP document (deleted) (PDF) for more details.

The program is (thanks to German blog reader Dekre for the hints) part of the so-called Business PC Security Projects of HP. Dekre wrote in a comment that it was also included in HP's Client Management Solutions (I didn't find anything on the page, but this page lists Sure Click). The articles here and here from 2017 describe the partnership between HP and Bromium, the developer of Sure Click. Blog reader Dekre send me also another link to this info page.

HP Sure Click is causing trouble

Basically, the above description for HP Sure Click reads like a very useful feature. Unfortunately the practice draws another image. For the first time I got in touch with the topic via Blog Reader Dekre. In the German blog post Killt Adobe Acrobat Prof XI Internet Explorer-Favoriten? I wrote in June 2018 about an observation from Dekre. He run into issues with Internet Explorer favorites, and he supposed, an Adobe Acrobat update might be the root cause. Later Dekre found out that it wasn't Adobe Acrobat that was causing the trouble, but HP Sure Click and its protective function. In a comment, Dekre wrote:

It is a new HP Business PC with Intel processor 7th Gen. HP ships various software preinstalled on these business devices, but the purpose of this software is unknown.

My issues has been caused by a security programs from HP, here specifically HP Sure Click and the browser add-on of this program. After I've deactivated this, it reactivated again, when IE 11 is restarted. I had always suspected the program. If you deactivate the services, it won't work. The respective add-on is still activated. If you have activated HP Sure Click correctly, you cannot choose within this program that it does not install an add-on in IE 11.

Dekre uninstalled the whole program and his issues was gone. So that was the first hint that there could be trouble with the tool. I did some more research on this blog post.

HP Sure Click isn't compatible with Windows

If you search a little on the web, you will come across some hits, where there are reports of trouble with HP Sure Click. In this article (deleted) in the Spiceworks Community from September 2018 a user writes about bigger issues.

• Opening a Word document with Office 365 led to a request to register the version of Office 365 – the user cannot use Office.
• Since the antivirus program was launched, Sure Click 'protected' it so that it could no longer be used.
• Downloading any kind of software was no longer possible because every browser marked every download as a virus.

The user writes that you can set a whitelist, but you can't really configure the tool. In January 2018, the Windows update KB40556892 and Sure Click collided. HP has this forum post and this forum thread on the topic.

The issues continue with HP Sure Click, as can be seen in the HP document HP Sure Click Advisory – HP Sure Click Does Not Work After Certain Microsoft Security Patches Are Applied. The document was first published in January 2018 and was last updated in September 2018. The message: Practically every update under Windows 10 leads to collateral damage with Sure Click. HP meanwhile indicates the following updates as problematic.

The updates for Meltdown and Spectre have probably deprived HP Sure Click of its 'business foundation'. As a result of these updates, an error message appears in various scenarios stating that HP Sure Click has not been initialized. HP has provided an updated version of Sure Click on the site. In the meantime, this HP document (as of November 14, 2018) has been released, which again addresses the issue of an 'HP Sure Click Initialization Error'.

(Source: HP)

This applies to all HP computers of the following models on which HP Sure Click is installed in a version prior to 4.1.0.5714.

• HP Elite x2 1000 series
• HP Elite x2 1011 G1 Tablet series
• HP Elite x2 1011 G1 Tablet with Power Keyboard series
• HP Elite x2 1011 G1 Tablet with Travel Keyboard series
• HP Elite x2 1012 G1 Tablet series
• HP Elite x2 1012 G2 Tablet series
• HP EliteBook 1000 Notebook PC series
• HP EliteBook 1050 G1 Notebook PC series
• HP EliteBook 820 G1 Notebook PC series
• HP EliteBook 820 G2 Notebook PC series
• HP EliteBook 820 G3 Notebook PC series
• HP EliteBook 820 G4 Notebook PC series
• HP EliteBook 828 G3 Notebook PC
• HP EliteBook 828 G4 Notebook PC
• HP EliteBook 830 G5 Notebook PC series
• HP EliteBook 830 Notebook PC series
• HP EliteBook 836 G5 Notebook PC
• HP EliteBook 840 G1 Notebook PC series
• HP EliteBook 840 G2 Notebook PC series
• HP EliteBook 840 G3 Notebook PC series
• HP EliteBook 840 G4 Notebook PC series
• HP EliteBook 840 G5 Healthcare Edition Notebook PC series
• HP EliteBook 840 Notebook PC series
• HP EliteBook 846 G5 Notebook PC series
• HP EliteBook 846r G4 Notebook PC series
• HP EliteBook 848 G3 Notebook PC series
• HP EliteBook 848 G4 Notebook PC series
• HP EliteBook 850 G1 Notebook PC series
• HP EliteBook 850 G2 Notebook PC series
• HP EliteBook 850 G2 Notebook PC Bundle
• HP EliteBook 850 G3 Notebook PC series
• HP EliteBook 850 G4 Notebook PC series
• HP EliteBook 850 G5 Notebook PC series
• HP EliteBook 850 Notebook PC series
• HP EliteBook x360 1020 G2 Notebook PC series
• HP EliteBook x360 1030 G2 Notebook PC series
• HP EliteBook x360 1030 G3 Notebook PC series
• HP EliteBook x360 830 G5 Notebook PC series

and running one of the Windows 10 versions listed below.

• Microsoft Windows 10 TH2 (Version 1511)
• Microsoft Windows 10 TH1 (Version 1507)
• Microsoft Windows 10 RS5 (Version 1809)
• Microsoft Windows 10 RS4 (Version 1803)
• Microsoft Windows 10 RS3 (Version 1709)
• Microsoft Windows 10 RS2 (Version 1703)

As a solution, HP proposes to install the HP Sure Click version 4.1.0.5734 provided on the site. This means: With every update of Windows 10 you have to expect issues with HP Sure Click. Then you have to wait for an update of the software and install it. Given these issues, I'd rather uninstall HP Sure Click from the machines using the Control Panel.