HiJackThis+ is a free utility for Microsoft Windows that scans your computer for settings changed by adware, spyware, malware and other unwanted programs. Shortly, consider it like Sysinternals Autoruns.
HiJackThis+ by Alex Dragokas is a continuation of Trend Micro HiJackThis development, based on v.2.0.6 branch and 100% rewritten at the moment. HiJackThis+ was initially supported by Trend Micro, but they have since refused support and closed its GitHub repository. HiJackThis+ is distributed under the initial GPLv2 license. It also includes several tools and plugins available as freeware.
New in version 3:
- Detects several new hijacking methods
- Fully supports new Windows versions
- New and updated supplementary tools
- Improved interface, security and backups
HiJackThis+ includes handy tools for manual malware removal:
- StartupList 2 (*new*)
- Process Manager
- Uninstall Manager
- Hosts File Manager
- Alternative Data Spy
- Services Removing Tool
- Batch Digital Signature Checker (*new*)
- Registry Key Type Analyzer (*new*)
- Registry Key Unlocker (*new*)
- Files Unlocker (*new*)
- Check Browsers" LNK & ClearLNK (as downloadable components) (*new*)
The difference from classical antiviruses is the ability to function without constant database updates, because HiJackThis+ primarily detects hijacking methods rather than comparing items against a pre-built database (signatures). This allows it to detect new or previously unknown malware - but it also makes no distinction between safe and unsafe items. Users are expected to research all scanned items manually, and only remove items from their PC when absolutely appropriate.
Therefore, FALSE POSITIVES ARE LIKELY. If you are ever unsure, you should consult with a knowledgeable expert BEFORE deleting anything.
HiJackThis+ is not a replacement of a classical antivirus. It doesn"t provide a real-time protection, because it is a passive scanner only. Consider it as an addition. However, you can use it in form of boot-up automatical scanner in the following way:
- Run the scanning by clicking "Do a system scan only"
- Add all items in the ignore-list
- Set up boot-up scan in menu "File" - "Settings" - "Add HiJackThis to startup"
- Next time when user logged in, HiJackThis will silently scan your OS and display UI if only new records in your system has been found.
HiJackThis+ 3.3.0.9 Alpha changelog:
- Added detection of autorun Null-values.
- Added the database of LolBin files with updates from lolbas-project.github.io service (thanks to @oddvarmoe, @bohops, @xenoscr, @ConsciousHacker, @liamsomerville, @wietze, @_josehelps)
- HijackThis fix is protected against accidental deletion of LolBin files that didn"t pass digital signature verification for some reason.
- Escaping http => hxxp.
- Additional information is displayed for unsigned files: company from the file properties and SHA1 hash.
- The way of obtaining paths to processes has been changed - it doesn"t require opening the process (thanks to @fafalone).
- O7 - TroubleShooting: improved checking of %Temp% system profiles.
- Auto-removal of DACL locks of HJT settings keys.
- More reliable handling the clipboard (thanks to @wqweto).
- MS certificates list has been updated (thanks to Sandor).
- Whitelists have been updated.
- Other fixes.
HiJackThis+ 3.3.0.10 Alpha changelog:
- Unlocked the ability to remove services with Microsoft-signed executable.
- Added company and SHA1 hash output for files with damaged digital signature, marked as "(invalid sign)".
- The allowed file size for hash verification has been increased to 300 MiB. If the check exceeds or fails, this will be indicated in the log.
- Improved digital signature verification: for Win 8+, the secondary signature (of the manufacturer) is displayed, if the primary signature by Microsoft.
- Bugs of the previous build have been fixed.
HiJackThis+ works on Windows 11, 10, 8.1, 8, 7, Vista, XP, and 2000 (32/64-bit, desktop, and server).
IMPORTANT: HiJackThis+ does not distinguish between good and bad items. Avoid altering your computer settings unless you"re an expert.
Download: HiJackThis+ 3.3.0.10 Alpha | 4.1 MB (Open Source)
Links: HiJackThis+ Homepage | Screenshot
