hijackthis - A free utility that finds malware, adware and othe

项目说明

Download

![]()
Latest build [v3.x] - Release

![]()
Stable build [v2 outdated] - not updated anymore

![]()

_(this is beta- - major changes are in progress; although it is definitely safe to use)_

HiJackThis+

HiJackThis+ (Plus) (pre called: HiJackThis Fork v3) is a fork and a continuation of the original Trend Micro HiJackThis by Merijn Bellekom de, once a well-known tool.

At the moment, it is a step-by-step 100% rewritten source code of the original engine, aimed to provide a full compatiblity with the most recent Windows OS and a balance beetween compiling very fast results in logfile and combatting with the most popular malware, inluding the one not known to other anti.

It is made by Alex Dragokas - a lawyer, security observer and malware researcher.

O

HiJackThis+ is a free utility for Microsoft Windows that scans your computer for settings changed by adware, spyware, malware and other unwanted programs. Shortly, consider it like Sysinternals Autoruns.

The difference from classical anti is the ability to function without constant database updates, because HiJackThis+ primarily detects hijacking methods rather than comparing items against a pre-built database (signatures). This allows it to detect new or pre unknown malware - but it also makes no distinction between safe and unsafe items. Users are expected to research all scanned items manually, and only remo from their PC when absolutely appropriate.

Therefore, FALSE POSITIVES ARE LIKELY. If you are e, you should consult with a knowledgeable expert BEFORE deleting anything.

HiJackThis+ is not a replacement of a classical antivirus. It doesn't provide a real-time protection, because it is a passi only. Consider it as an addition. However, you can use it in form of boot-up automatical scanner in the following way:
* Run the scanning by clicking "Do a system scan only"
* Add all items in the ignore-list
* Set up boot-up scan in menu "File" - "Settings" - "Add HiJackThis to startup"
* Next time when user logged in, HiJackThis will silently scan your OS and display UI if only new records in your system were found.

Tutorial

* Please, refer to the List of tutorials

Features

* Lists non-default settings in the registry, hard drive and memory related to autostart
* Generates organized, easily readable reports
* Does not use a database of specific malware, adware, etc
* Detects potential *methods* used by hijackers
* Can be configured to automatically scan at system boot up

Ad

* Short logs
* Fast scans
* Not necessarily to create fixing scripts manually
* No need for internet access or recurring database updates
* Already familiar to many people
* Portable

New in 2.6+

* Detects several new hijacking methods
* Fully supports new of OS Windows
* New and updated supplementary tools
* Impro, security and backups

HiJackThis+ also comes with several modules useful for specific analysis and removing malware from a computer:
* StartupList 2 (\*new\*)
* Process Manager
* Uninstall Manager
* Hosts File Manager
* Alternative Data Spy
* Services Removing Tool
* Batch Digital Signature Checker (\*new\*)
* Registry Key Type Analyzer (\*new\*)
* Registry Key Unlocker (\*new\*)
* Files DACL Unlocker (\*new\*)
* Check Browsers' LNK & ClearLNK (as downloadable components) (\*new\*)

Log analysis

IMPORTANT: HiJackThis+ does not make calls on what is considered good or bad.
You must exercise caution when using this tool. Avoid making changes to your computer settings without thoroughly studying the consequences of each change.

If you are not already an expert, we recommend submitting your case to an online help forum. Here are some suggestions:

English: Our GitHub ; GeeksToGo ; BleepingComputer

Russian: SafeZone ; CyberForum ; OSZone ; SoftBoard ; THG ; ; KasperskyClub

> Note: currently, only association can provide direct analysis of HiJackThis+ logs in our github 'Issues' section. Please feel free to ask help there (English/Russian only).

Technical support

* Actual short User's manual (in English)
* Actual complete User's manual (in Russian)
* Recent updates by the author (in Russian)
* Additional instructions on Wiki-pages
* Discussion and news are in this topic (in Russian) or at BleepingComputer (in English; access restricted to experts only) or on our GitHub page (for e).
* You can also freely ask questions, report bugs, or propose impro by creating an issue on GitHub

System requirements & Compatibility

* Microsoft™ Windows™ 11 / 10 / 8.1 / 8 / 7 / Vista / XP (32/64-bit desktop and server)
* WinRE & LiveCD are NOT supported

Copyrights

* Alex Dragokas { } - author of fork (major v3 and all post-v2.0.6 updates), refactoring, additions, tools integration
* Merijn Bellekom { } - original author, author of the new StartupList v2 and ADS Spy
* Trend Micro { } - owner of the original (2.0.5)

Thanks to:

* regist () { } - for the tips and ideas, user's manual, database updates, closed and beta-testing
* Sandor () { -Helper } - for the beta-testing, lot of reports, PC treatment on GitHub and forums of association
* akok () { } - for product promotion, pro a platform for tests and discussion, help with resolving conflicts with anti
* SafeZone.cc team (general community) - for promotion and support, feedback and bug reports, PC treatment on forums of association
* Fernando Mercês { } (Trend Micro) - coordinator of original HJT, for the tips, suggestions and promotion
* Loucif Kharouni { } (Trend Micro) - coordinator of original HJT, for the tips & suggestions

HiJackThis+ by Alex Dragokas is a continuation of Trend Micro HiJackThis de, based on v.2.0.6 branch and 100% rewritten at the moment. HiJackThis+ was initially supported by Trend Micro, but they ha refused support and closed its GitHub repository.
HiJackThis+ is distributed under the initial GPLv2 license. It also includes several tools and plugins a as freeware.

Reviews & Mirrors

(clickable)

![]() ![]() ![]()
![]()

Note: These mirrors belong to other companies. They are non-official.

More references:

* Wikipedia (EN)
* Wikipedia (RU)
* LabRats - Intro to HijackThis (Video)
* Please, report more links if you know :)

Other projects

You may also find my other programs useful:

Check Browsers' LNK & ClearLNK to cure shortcuts

Different tools at SafeZone repository.

My articles, tutorials and research (in Russian)

项目信息

开发语言：Visual Basic 6.0

Star 数：815

技术要点

该项目属于病毒分析方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕A free utility that finds malware, adware and other security threats展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。