aeb66f011e
3.5.0.1 - Updated certificates and databases. - Fixed Windows Defender Exclusion log. - Improved O23 - Service check logic. - Improved digital signature verification: Third-party files signed by a Microsoft Root CA will no longer be flagged as "Sign 'Microsoft'" if the trust chain ends with a non-Microsoft certificate. - Added detection for O7 - TroubleShooting (EV): %PATH% length overflow. - Added detection for suspicious environment variable entries. - Enabled display of SilentProcessExit entries, even when they are disabled. - Added a new tag (LolBin) to files frequently used for the fileless loading.
devel
dragokas
2026-07-02 23:27:42 +03:00
9858429518
3.4.0.17 Beta - Updated database of O4. - Check if BootExecute is missing or empty. - Step towards unifying the addition of new keys to open possibility moving them to the database. - Fixed a bug with the inability to clear value of the REG_MULTI_SZ type, previously they were just deleted.
dragokas
2025-01-17 00:04:12 +02:00
b3ac3260b3
3.4.0.16 Beta - Updated databases of O4, O20, O26. - Added detection of MS Office Addin. Microsoft and disabled records doesn't displayed. - Impoved search order of executable files through CLSID.
dragokas
2025-01-13 02:02:28 +02:00
ad27614538
3.4.0.15 Beta - Display free space of system drive, partition style (MBR, GPT) and storage technology (HDD, SSD) - Fixed inaccurate RAM calculation, also total amount of memory displayed, MiB replaced into GiB. - Added detection of Windows Server 2025. - Updated O4, O27 databases. - More reliable code for change services state. - Some optimizations.
dragokas
2025-01-10 16:27:20 +02:00
6c0d4fae8a
3.4.0.14 Alpha - O7 - Policy: added checking for plain login/password usage. - O26 - Debugger fix (thanks to thyrex). - Certificates and lolbin base has been updated.
dragokas
2024-12-25 20:53:22 +02:00
6dadb3633b
3.4.0.13 Alpha - O26 - Debugger: Added detection of Stack Rumbling method. - Fixed access denied in "AddToScanResults". - Added warning when profile Sids enumeration failed. - Microsoft certificates has been updated.
dragokas
2024-12-21 21:06:35 +02:00
d967cd0758
3.4.0.8 Alpha - The "Fix everything" option is blocked to protect inexperienced users. - Registry Key Unlocker: added the ability to specify SDDL and retrieve it from the descriptor of specified key. - Registry Key Unlocker: improved log formatting, added SDDL output before and after the fix. - Added the ability to specify keys in the format Computer\HKEY...
dragokas
2024-03-23 23:55:34 +02:00
381b04bfea
3.4.0.7 Alpha - File Unlocker: added the ability to specify SDDL and extract it from the descriptor of the specified folder (the "Pick from folder" button). - File Unlocker and Registry Key Unlocker: the "recursion" checkbox now sets the "inheritance" flag for all objects 2 and below level of hierarchy (previously inheritance was disabled and explicit permissions were set).
dragokas
2024-03-15 00:26:05 +02:00
f5a3ae6384
3.4.0.5 Alpha - Fixed: .cat file digital signature verification is failed.
dragokas
2024-02-19 22:19:11 +02:00
242f541836
3.4.0.4 Alpha - The maximum length of a log string is limited to 3000 characters. - The maximum length of a result list string has been increased to 600 characters. - Fixed regression: truncating long strings resulted in the removal of special annotations. - Fixed regression: truncated items couldn't be added to the ignore list. - Fixed regression: sometimes incorrect target expansion of shortcuts occurred. - Fixed regression: the "Add Checked to ignore list" button became inactive when saving the log. - O4 - Startup: the "(file missing)" annotation is now applied to the shortcut's target, not to the shortcut's own path. - O4 - Startup: Added expansion of script contents. - Removed duplication of some Jump list items. - Fixed: the program icon wasn't displayed when minimizing to the notification area.
dragokas
2024-02-08 01:21:20 +02:00
0be439f0f7
3.4.0.3 Alpha - Improved Windows Defender recovery procedure. - Fixed regression: coudn't add some items to ignore list.
dragokas
2024-02-06 22:54:37 +02:00
bf811491be
Update FUNDING.yml
Alex Dragokas
2024-01-28 20:17:46 +02:00
39ed4a0ba7
3.4.0.1 Alpha - Fixed a vulnerability in the buffer overflow of the scan results list. - Fixed a critical error in the HiJackThis backup restoration function: * It is not recommended to use the "Restore" button for backups in versions 3.3.0.5 - 3.3.0.11 without updating to this version, as it may destroy all other backups; * However, it is safe to revert to backups created by previous versions of HiJackThis. - Compatibility improvements and BCD fix when using registry restoration through Autobackup Registry: * ABR updated to v1.12 (thanks to D.Kuznetsov). - Fixed a crash on right-click on certain items in scan results (thanks to de-served for reporting). - O7 - KnownFolder: (folder missing) false triggering on legal redirection fixed. The redirection fix now also includes creating folder structure (thanks to de-served). - UI behavior fixes for Ctrl + F. - Fixed regression: item not being marked on double-click. - Added escaping www. => vvv. - Improved program update procedure for certificate errors (thanks to regist). - O22, O23 whitelists have been updated. - MS certificates have been updated (thanks to Sandor).
dragokas
2024-01-28 19:18:26 +02:00
ed3bca2dc4
3.3.0.11 Beta - O7 - KnownFolder: added checking for physically missing folders. - Fixed HijackThis installation error. - The Hosts File Manager tool is presented as a separate window. - Added Anti-BSOD when deleting services. - Fixed a bug where the standard font wasn't applied by some forms. - Added the ability to change the standard UI font separately from the list font. - Fixed errors in compatibility with XP/Vista, checking minimal processes on Win 8+.
dragokas
2023-12-21 23:05:57 +02:00
41269af84d
3.3.0.10 Alpha - Unlocked the ability to remove services with Microsoft-signed executable. - Added company and SHA1 hash output for files with damaged digital signature, marked as "(invalid sign)". - The allowed file size for hash verification has been increased to 300 MiB. If the check exceeds or fails, this will be indicated in the log. - Improved digital signature verification: for Win 8+, the secondary signature (of the manufacturer) is displayed, if the primary signature by Microsoft. - Bugs of the previous build have been fixed.
dragokas
2023-12-18 18:57:49 +02:00
4d803f8f50
3.3.0.9 Alpha - Added detection of autorun Null-values. - Added the database of LolBin files with updates from lolbas-project.github.io service (thanks to @oddvarmoe, @bohops, @xenosCR, @ConsciousHacker, @liamsomerville, @Wietze, @_josehelps) - HijackThis fix is protected against accidental deletion of LolBin files that didn't pass digital signature verification for some reason. - Escaping http => hxxp. - Additional information is displayed for unsigned files: company from the file properties and SHA1 hash. - The way of obtaining paths to processes has been changed - it doesn't require opening the process (thanks to @fafalone). - O7 - TroubleShooting: improved checking of %Temp% system profiles. - Auto-removal of DACL locks of HJT settings keys. - More reliable handling the clipboard (thanks to @wqweto). - MS certificates list has been updated (thanks to Sandor). - Whitelists have been updated. - Other fixes.
dragokas
2023-12-15 01:29:03 +02:00
f9c3b2e432
3.3.0.8 Alpha - Added escaping of line breaks and non-printable characters. Format: \x1F, where 1F is the ASCII code of the character in Hex. - Added remembering of the last opened folder in various tools. - Fixed file modification time during assembly. - Added build date to the log header. - Workaround for problems in Windows that prevent HijackThis from running.
dragokas
2023-11-27 01:06:12 +02:00
a76081e5ec
3.3.0.7 Alpha - Fixed broken checkboxes of lists after the latest update.
dragokas
2023-11-09 21:29:47 +02:00
b01d54abbe
3.3.0.5 Alpha - All UI elements have been replaced with Unicode counterparts (thanks to Krool and VanGoghGaming). - Fixed out-of-buffer writing in rare cases with incorrect registry keys. - Fixed insufficient control with an attempt to check the digital signature of a folder, which could lead to a crash due to the redirector being disabled (thanks to Sandor for the support). - Fixed Kaspersky false positive on the fix behavior. To prevent this from happening, unpack all utility files from the archive (thanks to akok for the notification). - Comprehensive cleaning and code "obfuscation" from primitive checks of antiviruses and sandboxes to prevent their suspicions (thanks to akok for the help). - Refactoring of the program initialization stage. - Loading of the main menu has been accelerated. - Hosts Manager: reset is standardized to the default hashes of the vanilla OS hosts file; fixed "Open in editor" button. - List of OS editions has been updated. - Improved compatibility with Windows XP and Vista. - Changed the settings storage key. The previous settings will be moved automatically. - Unnecessary databases are removed. - Dead links are removed. - Dependency on Microsoft MSCOMCTL32 is removed. - Temporary: dependency on the apps\VBCCR17.OCX component
dragokas
2023-11-02 16:04:41 +02:00
81b9c802c1
3.2.0.2 Alpha - Fixed a bug with displaying the user group name. - Fixed code looping on some interceptions. - The "Hosts file manager" module has been rewritten with more reliable code; added "Reset" and "Update" buttons; The "Open" button now launches the default editor. - The style of the main menu buttons has been replaced and unified to be identical in all OS versions. The buttons support themes, however so far only one theme has been drawn (dark). - Removed the "Misc Tools" button. - The "Online Guide" button has been renamed to "Tutorial & Support", and now opens a submenu with access to a choice of online/offline help and treatment forums. - Renamed the "List of Backup" button to "Backups". - Renamed the menu button "Help" - "Support" to "Report a bug". - The "Do a system scan..." buttons are no longer disabled when scanning; pressing again will switch you to the results window. - Fixed quality/cropped logo at DPI >= 150 (thanks to Eduardo and VanGoghGaming for help). - References to Dr.Web were deleted because the company no longer uses HiJackThis for the treatment on forum. - Minor corrections to the translation and the main project page. - Improved debugging mode.
dragokas
2023-10-09 20:19:35 +03:00
159811e22e
3.2.0.1 Alpha - [new] Added detection of O7 - Policy: Bitcoin wallet address hijacker is present (no fix). - [new] Added section O27 - Account & Remote desktop protocol. Description can be found in menu Help - About - Sections. - O7 - Autologon is moved in O27. - Added mark "(no fix)" - which means the fix is not provided. - Registry Key Analyzer: added option "Create key if not exists" (it should create key and instantly remove after checking if it didn't exist). - [clean] Pending delete file operations items are moved to whitelist (known as PendingFileRenameOperations -> DELETE). - Autobackup registry (ABR) is updated to v1.10. - Removed suggestion to use Uncle Carey's Windows 10 NetFix to fix O10 - LSP, because this utility became payed. For Windows 8.1 use other tools, like: https://support.kaspersky.ru/common/windows/12378 - Fixed compatibility with Windows XP. - Windows 2000 is no longer supported.
dragokas
2023-09-18 01:23:04 +03:00
6b39413c44
Update readme - How to build.txt
Alex Dragokas
2023-09-14 14:53:49 +03:00
cc35531e1b
deleted *.exe to comply with GPLv2
dragokas
2023-09-14 14:32:02 +03:00
96ec2a8a07
Update README.md
Alex Dragokas
2023-08-26 17:35:40 +03:00
a6162ffaeb
Update github templates
Alex Dragokas
2023-07-25 13:29:06 +03:00
100fc3c666
3.1.0.2 Alpha - EDS verification tool: * added expert options * added PE EXE filter (search for all files corresponding to the Portable Executable format) - O23 - Driver: Fixed skipping 3rd party drivers signed with single signature (by Microsoft). - O23 - Driver: If the third party driver is only signed by Microsoft, the "CompanyName" field from the file properties will be added to the mark. - Forced launch in "Additional Scan" mode if HJT v3.1.0.1 or lower was in use before.
dragokas
2023-06-20 01:07:37 +03:00
be36d317c6
3.1.0.1 Alpha - Added detection of O4 - Active Setup (thanks to regist). - Added flag (+safe mode) for services and drivers that starts in safe mode. - Added file signer to the logfile (in all sections where it makes sense): * for all Microsoft files the mark will look like this: (Sign: 'Microsoft') * unsigned files: (no sign) * files with signature verification error: (invalid sign) * files with a successfully verified signature, however without trust of the root certificate: (sign: '<Signer>', but untrusted root: '<Root Issuer>' with fingerprint: <hash>) * the signature is specified for the main file, not the argument. The exceptions are: O22 (based on Rundll32 and CLSID) and O23 host services, which displays the name of the dll signer. * other details can be found in additional help (RU only): https://www.safezone.cc/threads/dopolnenie-v-rukovodstvo-po-hijackthis.27470/post-333487 - EDS verification tool: * added field "Root Issuer" - name of the issuer of the root certificate. * added field "API error code" - GetLastError verification functions. Do not rely on this code as a validation result. * added field "Signer name (friendly)" - name of the signer, as it appears in the explorer properties window. * fixed lot of bugs. - Optimization of the file existence check code. - Support for Ctrl + A to select all text in input fields. - Fixed: Data corruption while copying/pasting text into input fields with a different keyboard layout. - Fixed: in O23 - Drivers some paths were specified with wrong redirector. - Fixed: missing -32 prefixes for some sections. - For O10 LSP Fix under Windows 8+ it is recommended to use Uncle Carey's NetFix utility. - Updated the list of well-known DNS address substitutions for O17. - Blocked possible closing of the window by the user in case of lag (thanks to The Trick). - Installer: Added shortcut "Registry Key Type Analyzer". - Auto-update: Improved installation of HiJackThis when it is shipped with multiple files. - Auto-update: Fixed several bugs when HJT is installed to another folder via /instDir key (thanks to de-served).
dragokas
2023-06-17 22:24:13 +03:00
2678194d26
3.0.0.6 Alpha - Fight against false antivirus detections: * Encrypted strings with Windows Defender keys * Rollback of CopyBytes optimization because Avira doesn't like this function :( * Temporarily moved to legit certificate which almost out-of-date - GitHub release link is replaced by static to a stable version 2.x, which will not be updated.
dragokas
2023-06-04 21:53:39 +03:00
a3ca1aff20
3.0.0.4 Alpha - Added BitsAdmin wait timeout (thanks Sandor) - Improved compatibility with AutoLogger software (thanks to regist) - Added new keys to O7 - Policy - Improved Boot Mode output (displayed only if enabled and supported by hardware and OS): * Added Secure Boot state (thanks Kazakevich O.) * added Test Signing state * added Debug Mode state * added Hypervisor enforced Code Integrity (HVCI) state - Added context menu Copy => File Hash
dragokas
2023-06-03 01:28:30 +03:00
ed3f423767
3.0.0.3 Alpha - Added definition of O7 - Account: UAC - Added O7 - Policy: *\..\Policies\Explorer\DisallowRun: Fix all - fixes all DisallowRun lines at once and sets the DisallowRun parameter to 0. - Displaying account type in AutoLogon. - Fixed: SFC wasn't performed for missing system files. - Fixed: The file name wasn't copied via the context menu if "File missing". - Fixed: DisallowRun displayed wrong state. - Improved Regexp in Registry Key Type Checker; fixed bug with field selection. - Fixed false positives of Additional subsections. - Fixed mark Boot mode: Safe Boot ("with" or "without network support" is always written). - Added the DataChecker class, which makes it easier to create definition rules. - Design change: * text format changes * Button "None of above, just start the program" renamed to "Settings" * Removed the checkbox "Do not show the main menu after starting the program" * DPI support for logo
dragokas
2023-06-01 00:44:20 +03:00
0aa0a51e2f
3.0.0.2 Alpha - The situation in Ukraine: sirens, sirens, sirens == insomnia. - "Additional scan" is included in the "default" settings. - O7 - Taskbar policy: added NoViewContextMenu, NoSecurityTab - Added display of current user account type: Local/Microsoft/ActiveDirectory/AzureAD/Internet (Windows 8 and above). - Remove symlink keys (source). - Better quality of taskbar icon. - Fixed missing menu icons when selecting a language with unicode characters. - Support Unicode text for the system menu (no context menu yet).
dragokas
2023-05-30 00:23:27 +03:00
724682e5fa
3.0.0.1 Alpha - F*ck them all, manifest is on github: https://github.com/dragokas/hijackthis - No f*cking release General: - Renamed program to HiJackThis+ (Plus) to refer to a specific product without confusion with other forks: * smooth transition from stand-alone exe version to multi-file version is planned * the program can no longer be launched from the archive directly * part of the modules is planned to be ported to C++ code with multithreading - Due to violation EU GDPR by the certificate authorities which doesn't want to remove personal data from the certificate, excessive cost, as well as the war in Ukraine, the software certificate will not be renewed: * when starting the program, the publisher name will be displayed as "Unknown" * the program will be supplied with a self-signed certificate with the name of Alex Dragokas * you can manually add this certificate to the Windows root store to continue see the publisher name in the UAC window. Instruction: https://github.com/dragokas/hijackthis/wiki/How-to-add-HiJackThis-root-certificate New: - Added section "B" - (Browsers); under development; output/fix of suspicious Google Chrome extensions is currently supported. - Added "Registry key type analyzer" tool (you can see symlinks, redirector type (presence of WOW companion and its type: Shared/Reflected/Simple key), virtualization, flags, date, etc.). Would be useful for researchers and developers. Functionality: - Added new marks: * "(missing)" - displayed for a missing registry entry (parameter or key). * "(access denied)" - displayed if there are no access rights to the object. * these marks are planned to be extended to work in all sections, but at the moment it only works in O7 [TamperProtection]. - x32 keys ("-32" sections) are displayed with normalized name now (\Wow6432Node\ is specified whenewer the section log record isn't shortened). Can be viewed fully through context menu "Jump". Bugs: - Fixed Digital Signature Checker: could give incorrect (pre-cached) data for some fields due to faster processing.
dragokas
2023-05-26 10:52:30 +03:00
c217afa171
Delete HiJackThis_dbg.exe
Stanislav Polshyn
2023-05-26 10:48:49 +03:00
b1c78f1911
Delete HiJackThis.exe
Stanislav Polshyn
2023-05-26 10:48:37 +03:00
262d963c5a
2.10.0.30 - Fixed potential error in retrieving paths of executable images on Windows 8.1- due to OS bug (thanks to HackerVlad). - TamperProtection will show an error code instead of the number 0 if an access is denied. - Fixed freezing for 15 seconds on Windows 10+ when checking BITS.
v3+
dragokas
2023-05-06 00:50:51 +03:00
26a951edcc
2.10.0.29 - Added O7 - AutoLogon. - O7 - TroubleShooting (EV): [PathExt] and [PSModulePath] moved to "Missing list" method, which means item is displayed if only system defaults missing. - Fixed Timer class overflow (thanks to Mikle Quits). - Fixed "Search on Google". - Some speed optimizations.
dragokas
2023-04-14 19:59:44 +03:00
c24f2d3b52
2.10.0.26 - Fixed system reboot on Windows 11
dragokas
2023-02-13 22:13:58 +02:00
c88d753c6b
2.10.0.25 - Fixed freeze while fixing O7 - TroubleShooting: (EV). - Whitelists Windows 11 has been updated. - Added detection of Windows Defender policies and restoring AMSI providers.
dragokas
2023-01-14 22:05:07 +02:00
a77e88e889
2.10.0.24 - Fixed ignore list operation when "Calculate checksum" option is enabled (thanks to Gordon-Dry for the notification).
dragokas
2023-01-11 03:31:08 +02:00
4676f27de1
2.10.0.23 - Context menu: Added button "Copy" - "File Argument". - Search: Save lastly entered phrase after program exits. - ADS Spy: fixed functionality of "Browse" button (thanks to Alexyz21 for report). - Uninstall manager: fixed location of "Remove Software" button. - Digital Signature Checker Tool: New buttons "Add folder", "Clear list". - Translation corrected.
dragokas
2022-09-03 20:10:38 +03:00
bb14c8575e
2.10.0.21 - Added free memory info and total CPU loading*. * loading data may be overestimated on weak processors. - Cut down icon metadata causing false positive detection by Sigma rules. - Fixed Hosts template and its ACL permissions according to reference. - O22 - Added -32 prefixes for 32-bit tasks on 64-bit OS. - Tools=>Unlock file/folder: Improved recurvive procedure of reset permissions.
dragokas
2022-08-28 21:21:23 +03:00
21f259eab8
2.10.0.20 - Several AppLocker fixes are done (thanks to regist for report, analytics and support): - O7 - AppLocker: Added detection of "ManagedInstaller" rule. - O7 - AppLocker: Fixed hash-based rule displayed one record instead of multiple. - O7 - Applocker: Improved "Fix all" procedure.
dragokas
2022-08-02 00:54:01 +03:00
368b1ea444
2.10.0.19 - Whitelist services is updated. - Some adjustment in O4 to show "(Microsoft)" postfix for more cases. - O22 - Tasks_Migrated: Added detection of migrated tasks in Windows 11. - O22 - Tasks: Added detection of tasks in SysWow64. - O22 - Tasks: fixed incorrect decoding of non-English characters by xml parser.
dragokas
2022-07-24 21:29:31 +03:00
f8d2493071
2.10.0.18 - Returned missing buttons in Uninstall Manager ^^ - Fixed broken functionality of 01 - Hosts (thanks to Boxersteavee for report). - Improved Hosts file read speed. - Improved registry export speed. - [Backup] CRC32 calculation speed and reliability are impoved.
dragokas
2022-05-28 18:40:35 +03:00
5339005445
2.10.0.17 - Added new Microsoft certificates. - Files unlocker: Added buttons "Add File(s) / Folder(s)".
dragokas
2022-04-07 16:54:33 +03:00
aa8c7cb351
2.10.0.16 - Added Spanish translation (thanks to Andago). - Added key /LangSP - force use Spanish language for user interface. - Corrected size of the forms for better match the translation. - Minor edits of RU/UA/FR translations. - Updated Merijn Bellekom donation link in StartupList tool. - StartupList (and HJT): fixed "Show file" context menu didn't work with System32 files.
dragokas
2022-01-12 22:55:02 +02:00
76d97f9149
2.10.0.14 - O22 - BITS: Fixed throwing error when URL is missing (thanks to @Sandor-Helper for report). - Certificates are updated.
dragokas
2021-12-26 18:05:24 +02:00
846b49fd6b
2.10.0.13 - Fixed potential crash related to bad buffer size in codepage encoder (thanks to @thetrik for letting me know). - Fixed missing translation. - Fixed font size on some controls. - [Updates checker] Corrected error code returned. - System errors description are now displayed on selected language. - [Uninstall manager] Fixed double-unicode in registry snapshot report on some locales. 2.10.0.12 - Updated MS certificates list. 2.10.0.11 - Improved error logging.
dragokas
2021-12-02 22:06:01 +02:00
e24ae53a4a
Update README.md
Stanislav Polshyn
2021-11-10 23:16:39 +02:00
b73483c2ee
2.10.0.10 - Added detection of Windows 11, Windows Server 2016, Windows Server 2022. - Added DisplayVersion in addition to ReleseId where possible. - O22 - Tasks: whitelists are updated. 2.10.0.9 - Moved status to a stable release. - O26 - Fixed false "file missing". - O7 Policy - Added more keys for detection DisableTaskMgr. 2.10.0.8 beta - More code clear. - Improved filter of O22 - Bits whitelists. 2.10.0.7 beta - Added new 'Files Unlocker' tool (see 'Tools' menu => Files => Unlock File / Folder). - Global code clear and optimization (thanks to LaVolpe and his 'Project Scaner' tool). - Some errors are fixed. - Improved source code building script.
v2.10.0.10
dragokas
2021-10-14 00:45:02 +03:00
02ba26299c
Delete Form1.frm
Stanislav Polshyn
2021-07-23 16:43:49 +03:00
24fb78037b
2.10.0.6 beta - Fixed: HJT uninstallation removes not all keys. - Fixed: Explorer is restarted in 'Limited Mode' after O21 Fix. - Fixed: O26 - Tools false positives. - Hotkeys: 'Ctrl' + 'Mouse Wheel' to change the font size of results window list. - More optimizations.
dragokas
2021-02-12 01:13:17 +02:00
a534f5cd45
2.10.0.5 beta - Search window: added option to search in filtering mode (only scan results window). - Search window: added option to mark all items automatically in filtering mode. - Search window: options are now can be saved with a diskette button. - Fixed throwing error when you close the program after fixing the item. - Improved path arguments parser. - Improved file/folder permissions reset. - Micro-optimizations.
dragokas
2021-02-08 19:14:25 +02:00
380abe023f
2.10.0.3 beta - All HKU\.DEFAULT prefixes are replaced by "HKU\S-1-5-18". - O4 - Run* - is now contains postfix with username for service Sids as well. - O7 - Policy: fixed DisallowRun item state. - Fixed unicode strings detection in US Locale. - Fixed missing restore feature in ABR backup.
dragokas
2021-02-05 18:40:45 +02:00
f9bf739001
2.10.0.2 beta - VirusTotal: added compatibility with Windows XP SP3 (thanks to @wqweto for help). - Fixed error in O21 scan (thanks to @Sandor-Helper for reporting). - Fixed BSOD on AppLocker fix, caused by MS GPUpdate. Instead, reboot will be prompted. - Fixed error in hashing the backup while fixing the items (thanks to regist for testing). - Updated certificates (thanks to @akokSZ for reporting). - Improved reset ACL, icacls.exe / takeown.exe are no more used. - Fixed ability to restore the item even if backup system failed to retrieve the file hash.
dragokas
2021-02-04 00:59:20 +02:00
4c667d9f6f
2.10.0.1 Beta New detections are added: - O4 - some new detections and improved fixes. - O5 - Applet: to detect custom and hijacked control panel items. - O7 - AppLocker: * NOTE!!! Applocker is by default in whitelisting mode: everything that is not explicitly allowed, is blocked. * If you remove "(allow)" rule, this particular application/folder will be blocked, until you'll remove all the rules. * To remove all rules at once, it's better to fix the special line "O7 - AppLocker: fix all" - O7 - KnownFolder: to detect and fix hijacked locations of "Known Folders". - O7 - TroubleShooting: new environment variables are added. - O22 - BITS Job: to detect foreign Windows Update Service jobs. - O22 - Tasks: (damage) subsection is added to detect damaged and garbage tasks of such types: * (user missing) - when user/group is removed; * (no xml) - when xml file doesn't exist; * (key missing) - when associated reg. key doesn't exist; * (no key) - when no task keys are referred to; * (empty) - when tasks folder or key contains an empty record; * This doesn't include xml integrity/CRC check and "DynamicInfo / Triggers" validation. Interface: - Added ability to mark multiple items for fixing with 'Shift + Click'. - Added "Copy" multi-context menu in scan results window (thanks @TheTrick for helping with Clipboard). - Added "VirusTotal" multi-context menu in scan results window with options to check file/URL by hash or to submit file with SysInternals Autoruns. Report: > General: - Sorting is now going in correct alphabetical order + increased the speed. - O4 - Startup subsections are renamed to improve the sorting. > /Area:Environment: - Added registry report of "User Shell Folders" and "Shell Folders" in addition to CLSID-based report. Why? Because Microsoft doesn't follow its own 'Best Practice' from MSDN. lol. > Modules "Check Browsers' LNK" & "ClearLNK": - Suppressed "Allow to download..." request when silent mode is selected in "Update" settings. - Added auto-update feature (whenever you run the tool) - not often than once per month. - Introduced the strong verification for the file digital signature before execution. - Tools are now will be downloaded in \Tools\Scan subfolder of HiJackThis dir or installation dir if one is performed. Other: - O4 - Fixed reading the other users startup folder; added user name postfix in log. - O25 - Fixed rare error in connecting to WMI. - Updated and improved LoLBin list check mechanism. - Improved registry functions. - Corrected free buffer (ILFree => CoTaskMemFree). - Explicitly allowed expired Microsoft certificates (without timestamp). - Updated whitelists of O2, O22, O23. - Added switch /skipErrors - do not show error messages and prevent warnings and errors from writing to log file at all. - Added switch /sha256 - calculate SHA256 hash of files. - Fixed hash progressbar. Tools: > Digital Signature Checker: - Improved speed, sorting, added columns - Certificate "Valid From", "Valid Until"; exchanged columns "File Name" / "File Path". > Uninstall Manager: - Fixed "Uninstall application" button is not always worked. > Process Manager: - "Save" button auto-refreshes process list. Special thanks to Sandor and regist for samples, testing and suggestions.
dragokas
2021-02-01 02:34:21 +02:00
0ec0e9b4a7
updated donation links
Stanislav Polshyn
2021-01-31 12:04:52 +02:00
4bc9785d42
2.9.0.27 (Nightly) - [*New*] Added subsection O26 - Tools: * various tools run by user manually, that hijacked in some way, will live there. - [*New*] Detection of Logon Screen Backdoor (Accessibility tools) is added to O26. - [*New*] Detection of My Computer properties tools hijack (Defragger, Cleaner, Backup) is added to O26. - [Fix] Fixed critical error in service whitelisting for x32 systems (thanks Sandor for report). - [Fix] Registry Jumper didn't want to jump to parent key when target doesn't exist. - Registry Key Unlocker: added the button "Open in Regedit". - Size and position of every tool and main window as well are now preserved after exiting the program. - [Limited user] Fixed crash when user updates HJT. - [Limited user] Some HJT functions and tools are blocked for limited user. Run utility as admin! - [Limited user] Generic improvement, preventing false positives in scan results caused by access deny.
dragokas
2020-09-01 19:46:08 +03:00
b361462b5e
Added COMSS and Dr.Web references
Stanislav Polshyn
2020-08-28 18:56:04 +03:00
c54cc4a94a
2.9.0.26 - Added partial compatibility when running as a limited user. 2.9.0.25 Databases: - Updated O22, O23 bases (MS Office, MS Visual Studio are also whitelisted if possible). - O22 - Added the ability to analyze Microsoft rundll32 based tasks. - Updated names of Windows editions. - Appended well-known DNS lists. - Reference IE StartPage, SearchPage, Search & Custom Assistant are replaced with msn.com or removed due to broken links. Functional: - Added checking of Windows / user startup-shutdown scripts policies. - Added O18 - Printer Port: detecting suspicious file ports for Spooler Shadow Jobs (thanks to Alex Ionescu for the article and NickM for helping with the fix). - When you request to restore from an ABR backup, a new backup is automatically created to enable rollback (may help to recover from a non-bootable state). - Added calculation of files SHA1 hash; you can switch between SHA1 / MD5 in the settings. - New switch: /sha1 - calculate SHA1 hash of files. - Context menu: added "Disable / Enable" item for services and tasks. Fixes: - O22 - added compatibility with tasks in UTF16 encoding. - Uninstall Manager: Fixed the "Save List" button (thanks to Severnyj for the notification). - Improved ini file disinfection functions, added Unicode format processing. - Improved registry backup functions, QWord support. - The function to get the file size sometimes returned 0 for files from System32. - Context menu is no longer blocked during ReScan. Interface: - Font for scan results changed "10" => "9" (Bold). - Added left and right indents in the "About ..." menu windows. - "About" - "Version history": fixed trimming of the end of the text. - The scrolling position is no longer reset at the end of the scan. - Fixed the transparency of the program icon. Other: - Updated internal manual on switches. - All internet links are replaced with https. - Added https protocol to the verification criteria. - R4 - PendingFileRenameOperations disabled in /startupscan mode due to false positives. 2.9.0.23 - New certificates are added - OSinfo: Windows Embedded is now detected and informed in log - OSinfo: new OS Edition names are added - Strict rules for HJT own command line parser - Fixed ignore list broken due to Windows 10 specific update mechanism - Some fixes on GUI, reboot, file access, path find, error description, HJT close, terminate process, shortcuts logic - New private command line keys for donators are added: * Silently check system using 3rd party tools such as from Sysinternals and NirSoft * Automatically remove items detected on Virustotal if found * Selective silent HotFixes (like clear Hosts, Policies, bad certificates and so) * Basic anti-rootkit - New public command line keys are added: * /noBackup - disable backup creation during the fix * /install /autostart d:X - install HJT in task scheduler to autorun with X sec. delay * /instDir:"PATH" - alternate installation path for HJT (by default: "%ProgramFiles(x86)%\HiJackThis Fork"). * /noShortcuts - disable creation of shortcuts during HJT installation via /install * /! - stop command line keys parsing. Everything found after this key considers as keys for HJT autorun (instead of default /startupscan). - Increased GUI max lines limit for O23 up to 750 items (default for other section is 250). - Added detection of: ...\Policies\Explorer\DisallowRun - O23 - Service Backup is improved. - O25 - Revert Backup is fixed. - Windows 7 EOS (and future Win 8/8.1 EOS) detection are added to O22 - Tasks
v2.9.0.26
dragokas
2020-08-08 16:39:40 +03:00
7d664e72d3
Delete _Lang_FR.zip
Stanislav Polshyn
2020-08-08 16:34:45 +03:00
ae78972629
Update README.md
Stanislav Polshyn
2020-07-18 20:52:05 +03:00
198a532c83
Updated github title (readme)
Stanislav Polshyn
2020-07-18 20:45:59 +03:00
05521ce1bd
Added issue templates manager
Stanislav Polshyn
2020-07-18 20:33:47 +03:00
36bece7a18
Delete ISSUE_TEMPLATE.md
Stanislav Polshyn
2020-07-18 20:19:32 +03:00
2fe8c25394
Update issue templates
Stanislav Polshyn
2020-07-18 20:19:14 +03:00
faaf0b24e3
Update issue templates
Stanislav Polshyn
2020-07-18 20:13:13 +03:00
46acd3ca5e
Updated Autologger link
Stanislav Polshyn
2020-07-18 19:46:34 +03:00
daf36ea800
Create FUNDING.yml
Stanislav Polshyn
2020-01-23 07:50:04 +02:00
2a7927793d
2.9.0.18 Fixed bug in loading HJT due to incompatible icon for 32-bit OS.
dragokas
2019-01-14 17:22:42 +02:00
b525bbcf0c
2.9.0.17 Fixed bug in loading HJT due to incompatible icon for 32-bit OS.
dragokas
2019-01-14 17:15:11 +02:00
e514eba3c7
2.9.0.17 Default font for lists is replaced by "MS Sans Serif", 10pt. Added hotkeys: Ctrl + F (search), Ctrl + A (select all). Improved compatibility with 64-bit OS when you open files for editing or its properties (in ProcMan, StartupList, ADS Spy). Fixed crash when parsing misformatted (encrypted) jobs due to error in stream reader. Other little edits of errors and interface. French translation is updated. Microsoft certificates database is updated. Added link to Chocolatey in github page.
dragokas
2019-01-13 19:50:46 +02:00
7d5ef8ee7a
2.9.0.11 Added translation into French (thanks to Colok { Colok-Traductions.com }). Fixed problems with displaying extended character set of ANSI codepage. R4, O22, O23 databases are updated. Source code builder script (makefile.cmd) has been improved: - now it include compilation of dependencies. - build Chocolatey project. - source code building is verified and guaranteed on fresh Windows XP / 7 / 10. Most exe-files (helper-dependencies) have been removed from the GitHub repository due to false positives. Donation information has been updated.
dragokas
2018-11-26 19:28:20 +02:00
bab3b807ab
2.9.0.7 Fixed false positives (e.g. O26) due to problems with buffer cleaning in registry operations.
dragokas
2018-11-16 11:59:00 +02:00
2ed3fd3322
2.9.0.6 Fixed critical error when recursive read registry key (app crash on some backups). Fixed cases with failures in reading O23 (error: "Collection key in not unique"). CSV-reports are now open in Notepad if association is not defined. Improved speed of O7 - IPSec analysis. Improved speed of regular expressions.
dragokas
2018-11-09 18:28:32 +02:00
077718ee60
2.9.0.1 [Log] v Improved format of the log lines. v Added mark "No suspicious items found!", if the number of entries = 0. v Added display of 'Scan mode': if enabled "Additional scan", "Environment variables", "Ignore ALL Whitelists" or disabled "Processes", "Hide Microsoft entries". [Backups] v Added backup/restore of O23, O25. v Restoring of library registration. v Restoring of the file attributes and time stamps. v Restoring of initial security rights on file / registry key (thanks to Kazakevich Aleh for help). v ABR from Dmitriy Kuznetsov is updated to v1.05 (improved compatibility with Win10 build 1803). [Main scan] v O5 - 'Blocked IE Options' - section is renamed and expanded to cover any hidden control panel items; added compatibility with Vista+. v O7 - Added detection of policies: NoViewOnDrive, RestrictRun, DisallowRun, NoControlPanel, LockTaskbar, NoDispCpl, NoDrives, DisableTaskMgr. v O7 - Added detection of restricted DACL permissions on some Policy and Certificate keys. v O7 - TroubleShooting: (EV) - added checking presence of essential system folders in %PATH%. v O10 - LSP: whitelist is removed. Checking is performed by EDS. v O10 - LSP: is now display all chain gaps and unknown providers and doesn't stop on the first found. v O18 - Protocols/Filters: criteria of checking is replaced with EDS; added check for registry subkeys. v O22, O23 - Windows Defender items are temporarily added to whitelist. v O26 - Added detection of UWP applications debugger ["Additional scan"] v Added subsection O23 - Drivers: - list of loaded drivers. v Added subsection O23 - Dependency: (experimental), consist of 3 groups: - Microsoft Service 'X' depends on non-legit service: 'Y' - Microsoft Service 'X' depends on non-legit group: 'Y' - Microsoft Service Group 'X' contains non-legit service: 'Y' (Note: some 3d-party services can legally add their records to Microsoft Service Group) ["Environment variables" scan] v Added listing of special folders. v The environment variables are supplemented and divided into categories "[User]", "[System]", "[Current process]". [Fixes] v O22 - Added removing of task's executable (if it is not belong to Microsoft). v O23 - Added cleaning of legit services dependency from the service that is being deleted. [Compatibility] v Added compatibility with DBCS-systems (locale-independence). v Added compatibility when launch via Local System context: - also mark "<=== Attention! ('Local System' account)" will be displayed in the log. - some tools will not be available in this mode due to security reasons. v Reduced CPU loading in the "Scan on system boot" mode. v File choosing dialog boxes are now support x64 bit folders (c:\Windows\System32). v Checking the write access for new log is replaced by AccessCheck() API to not interfere with AV. v Improved protection against BSOD. [Errors] v Bug: Fixed cases in Win8/10 when line O4 is marked as StartupApproved (disabled) instead of Run\Run32. v Bug: Fixed crash while HiJackThis finishing its work when launched from archive. v Bug: Fixed issue with 0 bytes size of the log, if StartupList was start just right before. v Bug: Fixed access denied while reading some tasks (thanks to Sandor for testing). v Bug: Fixed the failure of some functions when setting a specific date format in the system. v Bug: Fixed issue with displaying binary data in LSP log. v Finished "Jump to Registry/File" menu for O23 and other sections. v StartupList: added tracing the errors in /debug mode, fixed some errors that caused crash (thanks @Hostn4me for testing). [Updates checking] v Bug: Fixed updates checking. The program is untied from github due to problems with https on XP and is now downloaded from dragokas.com. v Added proxy support (Note: Socks5 is not supported) (thanks Sandor for testing). v Added option "Update to test versions" - if you want to receive the latest updates without waiting for a stable release. v Added option "Update in silent mode" - the program will automatically update and restart with the initial command line keys. [Interface] v Added ability to choose the font (for whole interface or for scan results list and input fields only). v Improved interface navigation during scanning. v The autoscrolling of the scan results list has been removed. v Horizontal scroll bar is added before scan is complete. [Translation] - The translation into Russian of the list of changes to individual Misc tools was completed. - Added ProcMan list of updates. - The Netherlands part is translated into English. - The spelling of the Ukrainian translation has been improved. - Updated English text with spell and grammar checking (thanks to Tanner Helland). [Tools] v START menu is appended with shortcuts of separate tools and plugins (upon installation of HiJackThis). v Accordingly, added command line keys: - /tool+StartupList - /tool+UninstMan - /tool+DigiSign - /tool+RegUnlocker - /tool+ADSSpy - /tool+Hosts - /tool+ProcMan - /tool+CheckLNK - /tool+ClearLNK v Uninstall programs manager is updated to v2.0: - Interface and format of the log lines is changed. - Improved x64 compatibility. - Added "Hidden" mark for the programs that could not be uninstalled via default Control Panel snap-in. - Added (no Uninstall command) mark for the programs that have no string to call uninstaller. - Added (User: username) mark for the programs that requires log in of another user to be properly uninstalled. - Added jump to registry key. - Added filter by HKCU / HKLM / HKU / Hidden / No uninstall command / Common Software. v Digital Signature Checker: - Fixed errors "Access denied" when verifying some files, protected with DACL. - Increased speed of system folder verifying. - Fixed issue with failure to work on Windows 7x64 SP0 and under some another conditions. - Added ability to verify and show 3d-party publisher of drivers on Vista+. v ProcMan: added ability to enum modules of 64-bit processes. v ADS Spy: added button "Save log". v ADS Spy: added support of ReFS file system. [Tutorial] v Completed work on the renewed Russian manual for the Fork and v2.0.5: https://regist.safezone.cc/hijackthis_help/hijackthis.html (thanks to regist) v Updated short help on sections (on English, Russian and Ukrainian), available inside the program and web-site: http://dragokas.com/tools/help/hjt_tutorial.html [Command line keys] v Added and modified /Area command line keys (the old version will remain working for backward compatibility): - /Area:Processes is replaced by /Area+Processes. - /Area:Modules is replaced by /Area+Modules. - /Area:Environment is replaced by /Area+Environment. - /Area:Additional is replaced by /Area+Additional. - Added key: /Area+Modules - adds a list of modules loaded by processes. In this case, their PIDs are displayed in the list of processes. - Added keys: /Area-Processes, /Area-Modules, /Area-Environment, /Area-Additional - forcibly exclude the corresponding section from the log, even if it is enabled by user settings. - Keys /Area have the highest priority over the others. v Added key /saveLog "Path" (or /saveLog "Path\File.log") - saves the report to the specified folder (and under the specified name, if the extension is specified as .log). v The key /silentautolog is now display a window in a miniature form. v The syntax of all keys is extended and now allows you to specify them with a hyphen, for example: -autolog [Other] v Installation of HiJackThis Fork is now available via command line (Chocolatey): 'choco install hijackthis' v Maximum limit of the file size to calculate MD5 is increased up to 100 MB. Added MD5 calculation to sections where it was forgotten. v Whitelists are updated for R4, O4, O7 - Untrusted certificates, O22, O23.
dragokas
2018-10-20 22:06:15 +03:00
3fab828831
Planned update
Stanislav Polshyn
2018-09-29 19:15:16 +03:00
791424f151
Merge pull request #43 from tannerhelland/patch-1
Stanislav Polshyn
2018-09-29 19:08:41 +03:00
420912a326
Merge pull request #41 from tannerhelland/devel
Stanislav Polshyn
2018-09-15 03:02:12 +03:00
42898389c5
Final (I hope) English translation update for 2.8.0.68
Tanner
2018-09-14 15:38:19 -06:00
44f63eebd1
Added spell checking made by @tannerhelland in pull request
Stanislav Polshyn
2018-09-11 19:10:04 +03:00
cc18b8a783
EN lang file updated to v.2.8.0.68
Stanislav Polshyn
2018-09-11 02:11:26 +03:00
63a852d7cd
2.8.0.4 Added translation into Ukrainian.
dragokas
2018-02-05 21:18:46 +02:00
c483beb0d8
2.8.0.3 Disabled O7 - IPSEC items is removed from the log. Improved working of options "Ignore Microsoft entries" and "Ignore All whitelists" with unchecked checkbox. O22 - Task: fixed error in output of status "(disabled)". 2.8.0.2 Logs: Log "Environment variables" replaced by with the output of all environment variables of the current process. O7 - Policy: [Untrusted Certificate] Black list of certificates and "Well-Known cert." attribute are removed. Added option "Additional scan" (disabled, by default). It can be enabled in File -> Settings Scan: O4 - PendingFileRenameOperations (moved to "Additional scan") O4 - Autorun.inf (added to "Additional scan") O4 - MountPoints2 (added to "Additional scan") O22 - Task: added attribute "(activation)" for tasks related to OS activation. O22 - Task: added attribute "(update)" for GWX tasks ("Get Windows 10"). O23 - Service: added output of arguments. Errors: Fixed bug, that lead to absence of process list in XP. Fixed bug in working with collections, that could lead to application crash. Fixed several errors, when O23 malware entries were not included in report. Fixed app crash when user attempt to close it before StartupList2 finishes its working. Fixed work of checkbox "Mark everything found for fixing after scan". Fixed bug when trying to add HJT to startup beeing launched via Start menu and also on XP/2k systems. Protection: Improved protection against removing system files when EDS mechanism is damaged. Added protection from finishing system critical processes. Fixes: O21: added restarting of Explorer. O4: added process freezing. O22: added finishing of task. Interface and other: Added icons to the tools and removed unused from resources. Added multilingual description in file properties (DE/FR/EN/RU). Menu "Misc Tools" is reorganized: - additional settings is moved to main settings menu; - added section "Plugins"; - added buttons "Registry Keys Unlocker" and "Digital signature checker". Main settings are splitted into categories: - Scan area - Scan options - Fix & Backup - Interface Option "Ignore Microsoft files" is renamed into "Ignore Microsoft entries" Option "Ignore non-standard but safe domains in IE (e.g. msn.com, microsoft.com)" is absorbed by "Ignore Microsoft entries". Added tooltips to some checkboxes. When HiJackThis.exe launches from archive, now it is asking for unpacking into {Desktop}\HiJackThis subfolder, not a root of desktop. Improved scan speed on highly-loaded systems in /silentautolog mode. Added command line keys: /Area:Process - include list of running processes in report /Area:Environment - include environment variables in report /Area:Additional - execute "Additional scan" Whitelists has been updated.
dragokas
2018-02-03 20:20:44 +02:00
6342100530
Delete VersionPatcher.exe
Stanislav Polshyn
2018-02-03 20:05:01 +02:00
099422e50b
2.7.0.29 All sections of the log are unified to cover a single template "Section prefix-bitness" - "optional, section name": "hive\..\key": "optional, subkey" [parameter] = value "Compressed" log O7 - IPSec: in case system has several identical rules. Deleted attribute O7 - TroubleShoot: [EV] (environment value is altered) Added attribute O7 - TroubleShoot: [EV] (folder is not exist) Attempting to fix a line with a legitimate file will now call SFC for it. Separated into several lines with the possibility of separate fixes: - O4 - HKLM\..\Session Manager: [BootExecute] - O17 - ... Parameters: [NameServer] (finalized) - O20 - HKLM\..\Windows: [AppInit_DLLs] - O26 - IFEO (global).
dragokas
2018-01-19 23:46:10 +02:00
bc451952c5
2.7.0.28 Fixed app crash when program is finishing its working. Updated and improved script for retrieving new crash dump of program: http://dragokas.com/tools/debug/GetHJT_dump.zip
dragokas
2018-01-01 22:59:52 +02:00
315f0cddef
Delete 7za.exe
Stanislav Polshyn
2018-01-01 22:58:33 +02:00
e3e3d4c74d
Delete procdump.exe
Stanislav Polshyn
2018-01-01 22:58:26 +02:00
9da82cb854
2.7.0.27 O7 - Fixed output of certificates' owner name. O7 - Added output of owner's name for certificates not listed in HJT database. O7 - Added item "Policy: [Untrusted Certificate] Fix all items from the log", to fix all certificates at once listed in the log, if number of lines > 10.
dragokas
2017-12-25 19:42:00 +02:00
6b1ca41ec0
2.7.0.26 Updated list of DNS. O4 - Added output of folders in Autostart directories. O2, O3 - fixed heuristic cleaning. R4 section - DefaultScope is merged with R4 - SearchScopes. Little speed optimizations. 2.7.0.25 Updated list of certificates on XP.
dragokas
2017-12-23 16:01:53 +02:00
9cf00f2d69
2.7.0.24 Fixed error where log file created as trimmed due to the NUL characters. Uptime is removed. Finished translation of the list of updates into English. Lists of updates of HJT, StartupList and ADSSpy are added to the tab in menu "Help" -> About HJT -> History. R4 - SearchScopes: Changed format of log line.
dragokas
2017-12-15 00:56:41 +02:00
09b77f6592
Delete readme - History.txt
Stanislav Polshyn
2017-12-14 00:55:53 +02:00
2e2557178e
Add files via upload
Stanislav Polshyn
2017-12-11 22:47:39 +02:00
dragokas