Security Tool HijackThis Goes Open Source

← Back to Stories (view on slashdot.org)

Security Tool HijackThis Goes Open Source

Posted by samzenpus on Sunday February 19, 2012 @05:40AM from the check-it-out dept.

wiredmikey writes "The popular free security tool HijackThis has been open sourced by its owner, Trend Micro. The tool scans systems to find settings that may have been modified by spyware, malware or other programs that have wiggled their way onto a system and caused problems. Downloaded over 10 million times, HijackThis generates reports to help users analyze and fix an infected or problem computer. But the tool is not designed for novices – and doesn't actually determine what's good or bad. That's up to you, but it is a good way to keep an eye on things and possibly locate anomalies that may have been missed by other security products. Trend Micro warns that if you don't know what you're doing, it's probably not a good idea to make any changes to your computer settings and system files. Trend Micro acquired the tool from creator Merijn Bellekom in 2007, and has offered it for free ever since, but now is making the code available to the public. The code, originally written in Visual Basic, is now officially available at Sourceforge here."

75 of 101 comments (clear)

Min score:

Reason:

Sort:

Free = no good by Ritz_Just_Ritz · 2012-02-19 05:46 · Score: 4, Funny

My PHB says that free stuff can't be any good. Surely, we'd be much better off by throwing 7 figures at Symantec. ;)
1. Re:Free = no good by bws111 · 2012-02-19 05:50 · Score: 4, Insightful
  
  More likely he says that free stuff without vendor support is no good, and for most businesses he is right.
2. Re:Free = no good by jo_ham · 2012-02-19 06:02 · Score: 3, Funny
  
  If you use Symantec you'll certainly be throwing *something* at them.
3. Re:Free = no good by Lumpy · 2012-02-19 06:12 · Score: 4, Funny
  
  7 figures? you guys only buylow grade garbage. you should by 8 or 9 figure solutions.
  
  --
  Do not look at laser with remaining good eye.
4. Re:Free = no good by Ardyvee · 2012-02-19 06:21 · Score: 1
  
  I'll assume that the beeping I hear so loud is the sarcasm-meter.
  It's a move that'll give them good PR with the Open Source guys AND possibly leave them off the hook on maintaining the tool. Or maybe they just want to be good guys and let the tool evolve by other means (if it evolved at all in these past few years). No idea, tho.
  
  --
  I don't care if I'm wrong. I only care about everyone obtaining something from the discussion.
5. Re:Free = no good by newcastlejon · 2012-02-19 06:29 · Score: 1
  
  Back when I was in high school I heard about something called "Lee-nux", so I asked our network admin, who was more knowledgable than the actual IT teachers. His reply could be summed up as "Pfft! It's a waste of time! You get what you pay for, boy."
  Thinking back, I could kick him for setting my curiosity back by what must have been years.
  These days I still don't use Linux, but not because it's free. I did recently retire an old fileserver running BSD, though.
  
  --
  If God forks the Universe every time you roll a die, he'd better have a damned good memory.
6. Re:Free = no good by Creepy · 2012-02-19 06:57 · Score: 4, Insightful
  
  That is if you need to have accountability, such as selling or providing to a customer (this would be the latter - IT provides for its "customers" which are end users to them) but I think our developers use notepad++ for editing files more than any other program, so there are exceptions, and let's face it - if that tool breaks, there's always notepad. It is on our site license approved software download page even (for free and commercial tools we have a site license to download and self install), so it has passed through upper management and legal, but I'll admit the one there is an old GPL-2 licensed version - I don't know if it hasn't been updated because of legal concerns about GPL-3 or they just haven't gotten around to it, though (I know GPL-3 libraries are forbidden, but not sure about apps).
  In the case of HijackThis you are responsible for your own accountability, since it doesn't remove anything unless you tell it to, and a good IT person will back up the registry before making any changes to it (and know what is and is not a legit program).
7. Re:Free = no good by mysidia · 2012-02-19 07:11 · Score: 1, Insightful
  
  More likely he says that free stuff without vendor support is no good, and for most businesses he is right.
  It's not just about Vendor support; it's also about Tool capabilities, Tool quality, and meeting a business need. Businesses don't want to spend a lot of time manuallg "cleaning up" after malware infections; they want to prevent them.
  If the infection beats the protection, then the cleanup must be fast and fully automated, otherwise it's more efficient to re-image in this situation.
  HJT is for home users and hackers not working on company time, who can afford to spend hours upon hours manually digging through a log and removing suspicious components, at risk of breaking the system further.
  For day-to-day business use, HijackThis has nothing on Trend Micro OfficeScan, Malwarebytes Pro, PrevX Business, Webroot Secureanywhere Endpoint, eEye Blink, Defensewall/Parador, SuperAntiSpyware PRO, ESET, and plenty of others.
  Real-time protection, automation/periodic scans, and central monitoring capabilities are a must for good endpoint security.
  HJT has limited use cases. Symantec's product don't make the Top10 list.
  Perhaps since they've open sourced HJT now, there will be more developers working on it, and its capabilities could improve -- for example, automatically identifying items that are suspicious, and automatically identifying items that are system critical, and verifying their integrity.
8. Re:Free = no good by tnk1 · 2012-02-19 07:21 · Score: 1
  
  Thing is... he was right, from a professional perspective. Do not underestimate the amount of work that was needed to turn Linux into a kernel that could support an enterprise level requirement. If anything Linux was more a triumph of the open source model than a triumph of Linus' code (although that certainly was not terrible).
  If you were a hobbyist, Linux was great, and it goes without saying that it had what it took to be turned into something great. Still, when you ask a pro what he thinks of what was, at the time, a toy, the response was predictable.
9. Re:Free = no good by newcastlejon · 2012-02-19 07:45 · Score: 2
  
  If you were a hobbyist, Linux was great, and it goes without saying that it had what it took to be turned into something great. Still, when you ask a pro what he thinks of what was, at the time, a toy, the response was predictable.
  What galls me in retrospect is that I was a hobbyist, and the admin was not what I now consider a pro, considering how badly run the network was in those days. With respect to your comment on Linux being a toy at that time, all I can say is that you've overestimated my age by quite a bit: at that time Red Hat were doing pretty well, all things considered.
  Of course, if I was looking for enthusiastic encouragement then talking to an overworked admin that had to deal with a couple of thousand students was probably a bad idea.
  
  --
  If God forks the Universe every time you roll a die, he'd better have a damned good memory.
10. Re:Free = no good by dimko · 2012-02-19 09:17 · Score: 1
  
  Sure thing, and companies like IBM are wrong. And Red Hat makes no money.
11. Re:Free = no good by NJRoadfan · 2012-02-19 09:29 · Score: 1
  
  More likely he says that free stuff without vendor support is no good, and for most businesses he is right.
  It's not just about Vendor support; it's also about Tool capabilities, Tool quality, and meeting a business need. Businesses don't want to spend a lot of time manuallg "cleaning up" after malware infections; they want to prevent them.
  So whats the business need of Symantec's Endpoint Client? Malware steamrollers over it all the time, even with the latest definitions.
12. Re:Free = no good by mysidia · 2012-02-19 10:18 · Score: 2
  
  So whats the business need of Symantec's Endpoint Client? Malware steamrollers over it all the time, even with the latest definitions.
  That's because the software fails to do what it's actually supposed to do. If the software were effective, the featureset would make it a clear winner over the free product. Because in actual practice the Symantec software doesn't do what it's supposed to do, an Engineer experienced with it could tell you that all those checkboxes are worthless.
  In a number of large companies, corporate management fails to make a distinction between what the software vendors' salespeople say their software does, and what it actually does in practice.
  I'm definitely not holding up Symantec as a product you should consider using. But there are many alternatives that do what they are supposed to do, and have the must-have features you really need for assuring Enterprise security.
  And HJT still isn't the answer for endpoint security.
13. Re:Free = no good by Rakishi · 2012-02-19 10:28 · Score: 2
  
  If the infection beats the protection, then the cleanup must be fast and fully automated, otherwise it's more efficient to re-image in this situation.
  Define more efficient. Does the hours upon hours someone spend re-installing and re-configuring their system after a re-image count? What about the time spent reloading data from backups? And the time making an image because the last backup was a week ago? Then having to manually reload the files that have changed since that time?
14. Re:Free = no good by bws111 · 2012-02-19 10:52 · Score: 1
  
  I'm pretty sure IBM and Red Hat were some of the major players that did the work he is talking about.
15. Re:Free = no good by mysidia · 2012-02-19 12:10 · Score: 3, Insightful
  
  Does the hours upon hours someone spend re-installing and re-configuring their system after a re-image count?
  The image is supposed to be taken after the install is fully configured with all the role-specific software.
  What about the time spent reloading data from backups?
  No data requiring backup is allowed to be on endpoints. Any documents should be in the user's profile which gets redirected to a place on the server.
16. Re:Free = no good by hairyfeet · 2012-02-19 15:11 · Score: 1
  
  While I agree about meeting a business need sometimes free works quite well. For example i give my SMBs Comodo Internet Security which is free for BOTH home and business use and works great. if later on they run into some situation where they actually need support Comodo will be happy to sell them support so if they have no problems then it costs nothing. I've found if you use Win 7 (with its ASLR and DEP) along with Comodo Dragon with ABP (Dragon supports Win 7 low rights mode by default) and then finally comodo Time machine so if they DO somehow manage to bork something they can just hit the rewind button, even if they screw it up so bad it won't boot? Well you end up with a machine that short of hardware failure is pretty damned hard to kill or screw up. That of course makes both my business and home users VERY happy. When you have customers that could kill a Sherman tank with a toothbrush (I swear they must have like an electromagnetic field or something the way things just die around them) then you quickly learn how to harden a system.
  As for TFA as another noted maybe by being FOSS now they will have developers work on the usability, maybe have a "dummy mode" for the less skilled. because while HJT is a great tool it is NOT for the faint of heart and if you don't know what you are doing you could quickly break more than you fix. Maybe someone can tie it in with the signatures for Housecall or clamAV so it has a default nasty list?
  
  --
  ACs don't waste your time replying, your posts are never seen by me.
17. Re:Free = no good by onepoint · 2012-02-19 15:39 · Score: 2
  
  it's a tool, and the tool is only as good as the person using it.
  I love it since it helps me examine the problems before trying a solution.
  is it and endpoint solution for the masses ... nope not one bit.
  is it a good tool for the IT department to have on the flash drive at all times ... Yep, it's a tool to look inside before doing the surgery.
  
  --
  if you see me, smile and say hello.
18. Re:Free = no good by X0563511 · 2012-02-19 16:10 · Score: 1
  
  I can't see how a program could be forbidden just by being GPL3. From my understanding, the GPL does not "protect" or "infect" (depending on your perspective) program output - merely said program's code (be it for execution or linking (and execution)).
  
  --
  For large sets, this will be our guide even unto death, for the LORD will work for each type of data it is applied to...
19. Re:Free = no good by X0563511 · 2012-02-19 16:11 · Score: 1
  
  Wrong. Kind of hard to improve upon a program when it's closed source and only distributed via a compiled binary.
  
  --
  For large sets, this will be our guide even unto death, for the LORD will work for each type of data it is applied to...
20. Re:Free = no good by X0563511 · 2012-02-19 16:14 · Score: 2
  
  Not everyone works in a functional cubicle where they all use the same software to do the same thing, and the only thing that shouldn't be persistent is the output data itself.
  You're confusing bean counters, data entry, and script readers with just about everyone else who needs some flexibility.
  
  --
  For large sets, this will be our guide even unto death, for the LORD will work for each type of data it is applied to...
21. Re:Free = no good by berzerke · 2012-02-19 17:50 · Score: 1
  
  ...i give my SMBs Comodo Internet Security which is free for BOTH home and business use and works great..
  While I do use Comodo myself, don't think for a second that it's anti-virus engine is very good. It's not. If you want a good AV scanner, go with Kaspersky or Bitdefender, although neither are free :(.
  Where Comodo shines it's defense plus engine, which let's you know that something suspicious is going on. Answer properly the pop-ups, and nothing will get through. But that's the key, "Answer properly". I don't believe the average computer user can do that.
  ...Maybe someone can tie it [HJT] in with the signatures for Housecall or clamAV...
  I can tell you that from my testing, relying on clam is extremely risky. I'd love to recommend a FOSS solution, but I'm submitting stuff it misses virtually every time I find malware and test clam against it.
22. Re:Free = no good by Kalriath · 2012-02-20 09:08 · Score: 1
  
  You manually reinstall your software? We just network boot the machine to reinstall Windows from our gold image, and once done the software will automatically push to it and install with no user intervention. Reconfiguring indeed.
  
  --
  For a site about things like basic rights, Slashdot users sure do like to censor "dissent".
23. Re:Free = no good by hairyfeet · 2012-02-21 02:12 · Score: 1
  
  Actually you must not have tried Comodo CIS lately as they now don't ask the user much at all and has a "default deny" policy that covers a good 90%+ of use cases. The only false positives I've seen is my gamer relatives using trainers which considering trainers work by modding others code i don't know if that should count as a false positive or not. But I agree you shouldn't rely on ANY AV by itself, defense should be in depth which is why i give them Comodo CIS along with Comodo Dragon on Windows 7 with Comodo Time Machine. Those four work quite well together, with Win 7 blocking nasties with low rights mode, ASLR and DEP, the Dragon has SecureDNS and phishing protection and Time Machine is for PEBKAC problems. But if you look at the reviews Comodo CIS usually is in the top 5 pretty regularly which is really good for a free AV IMHO. The only one that scores higher in the freeware category is Adaware and its home use only.
  
  --
  ACs don't waste your time replying, your posts are never seen by me.
24. Re:Free = no good by phorm · 2012-02-21 08:28 · Score: 1
  
  I'll update that to say:
  More likely he says that free stuff without *good* vendor support is no good, and for most businesses he is right.
  I've seen several cases these days with large vendors where their support was quite shoddy. Their support people don't seem to know much about their product (especially for win-centric products with a linux component), they take forever to turn around a case and love to play wheel-of-blame where they'll try and put any possible issues on your system/configuration before accepting that yes, perhaps their product does have a bug.
  IMHO, companies I've found that have seem to good support include:
  Cisco: very good at turnaround for hardware failures
  RedHat: good turnaround on tickets. They usually manage to focus in on the problem within a decent timeframe
  Dell Corporate: good RMA process with cross-shipping (do not confuse this with consumer-level support, which can be very different)
  Of those and others, the trend seems to be that hardware companies have good support. Software companies are not quite so great for support (RedHat being good especially considering they're not necessarily the creator of said software)
25. Re:Free = no good by tnk1 · 2012-02-21 11:21 · Score: 1
  
  Get off my lawn.
26. Re:Free = no good by mysidia · 2012-02-21 14:20 · Score: 1
  
  it's a tool, and the tool is only as good as the person using it.
  A tool is also only as good as the functionality it provides. You don't use a hammer to make a chocolate cake.
  HiJackThis is a useful tool, but its application is extremely constrained -- its a tool to be used by an expert/specialist to attempt to manually remove an infection.
  This has many applications, but its uses are not compatible with IT best practices for Enterprise security. In the Enterprise, the main job of security software is to prevent the infection, if a machine becomes infected, than that machine from now on is questionable, the security risks of just attempting a manual removal are great (if some remnant is missed, corporate secrets or customer data may be at risk, huge possible liabilities), and the only appropriate resolution is really to reimage.
  Again HJT is more suitable for home users and "PC Repair shops"; where the objective is to repair an arbitrary home computer with least expense to the owner, and malware removal can be a full-time job.
  In well-managed Enterprises, "manual malware removal" is not a job at all let-alone a full time one, where the skills required to utilize HJT would be valued specifically.
  Now, the security consultants or hackers the Enterprise hires to help clean up after a massive security incident, would be HJT experts.
Still in Visual Basic by svick · 2012-02-19 05:48 · Score: 5, Informative

Since it was "originally written in Visual Basic", I wonder what language does it use now?
It turns out, it still uses Visual Basic. Not sure why was the summary written that way.
1. Re:Still in Visual Basic by sgt+scrub · 2012-02-19 06:01 · Score: 1
  
  Not sure why was the summary written that way.
  They are anticipating the translation to Javascript + HTML5. Isn't that what Microsoft replaced VisualBasic with?
  
  --
  Having to work for a living is the root of all evil.
Re:Where? by Foxhoundz · 2012-02-19 05:52 · Score: 5, Informative

They're using Subversion to manage the code: http://hjt.svn.sourceforge.net/viewvc/hjt/
Java trapped by tepples · 2012-02-19 05:56 · Score: 2

Say I find a Windows PC, remove its hard drive for analysis, put it in a USB enclosure, and mount it read-only on a Linux box to make the scan process immune to boot-sector malware. Is there a Free compiler capable of compiling Visual Basic code? As of a year ago, there wasn't. If not, the program is Java trapped.*
* The term's origin is historical; Java itself is no longer Java trapped, but plenty of other languages and APIs are.
1. Re:Java trapped by Anonymous Coward · 2012-02-19 05:57 · Score: 4, Insightful
  
  You could always get a life, realize that operating systems are not the end all of existence, and use a Windows machine to scan the hard drive.
2. Re:Java trapped by jo_ham · 2012-02-19 06:04 · Score: 1
  
  So it's not open source enough?
  It wasn't open source at all until recently!
3. Re:Java trapped by lytithwyn · 2012-02-19 06:17 · Score: 1
  
  Is there a Free compiler capable of compiling Visual Basic code?
  A quick google search led me to several sites that say Mono now includes a Visual Basic compiler. I haven't verified this myself.
4. Re:Java trapped by Voyager529 · 2012-02-19 06:17 · Score: 5, Informative
  
  You could always get a life, realize that operating systems are not the end all of existence, and use a Windows machine to scan the hard drive.
  This.
  If you're that averse to installing Windows on something, check out some of the bootable diagnostic tools like the UBCD4Win project, the newer releases of Hiren's Boot CD (That are now pirated-software free), or HawkPE. They run right off the disc and have HijackThis - along with a plethora of other cleanup tools - pre-configured.
5. Re:Java trapped by Creepy · 2012-02-19 07:22 · Score: 1
  
  there are a bunch here
  http://livecdlist.com/purpose/windows-antivirus
  I've had better luck finding rootkits with bitdefender and kaspersky than Hiren, but taking a look at their page it looks like they've shored up the rootkit detection (MalwareBytes is pretty good at that - didn't have any luck with rootkitrevealer when I tried it, though - it failed to detect a rootkit that bitdefender found, and I knew the machine was rootkitted as well as the rootkit name - I also pulled off 3 yet unidentified virus variants off of that box and submitted them, and they began appearing in antivirus software within 2 days). I also have my trick of finding rootkits while windows is running, as most don't hide file complete (usually I find a registry entry with HijackThis and then go to the location and start typing in the name and hit tab - if I see the file but don't see it if I just do dir filename, I know I'm working with a rootkit and probably not an ordinary virus). I prefer to have antivirus software remove viruses and rootkits, but can do it by hand if necessary (would rather have it magically go away rather than poking around system files for hours to see what all it corrupted).
6. Re:Java trapped by icebraining · 2012-02-19 07:23 · Score: 1
  
  That are now pirated-software free
  How so, if they contain Windows?
  
  --
  Dilbert RSS feed
7. Re:Java trapped by icebraining · 2012-02-19 07:28 · Score: 2
  
  Despite the similar name, they're not the same. Mono supports Visual Basic .NET, which is a language both syntactically and semantically different.
  
  --
  Dilbert RSS feed
8. Re:Java trapped by LordLimecat · 2012-02-19 08:00 · Score: 2
  
  It doesnt matter terribly much. As anyone who does this type of thing might know, most (basically all) of these type of Windows-based programs which access the registry rely on kernel and system mechanisms to read/write the registry.
  In other words, its great if you have it running under wine, but it wont actually do anything because Wine doesnt provide mechanisms for reading an actual NT registry. There are two programs I know of which re-implement those mechanisms under Linux: the NT Password reset / editor, and Raw Registry Editor-- either of which will allow Linux to open an NT registry.
  And honestly it makes sense, since there is no reason to expect one to use HijackThis outside of Windows in 99% of the cases, and it would be rather like expecting The Gimp to implement ext4 read / write functions so that one can launch it under windows and access files on a Linux FS: it adds an enormous amount of complexity to the project with minimal gain.
9. Re:Java trapped by LordLimecat · 2012-02-19 08:02 · Score: 1
  
  Then you will have a hard time reading the Windows registry anyways, since HijackThis uses Windows APIs to do that.
10. Re:Java trapped by LordLimecat · 2012-02-19 10:49 · Score: 2
  
  The point of the thread was whether it would compile under linux. It might, but it wouldnt do anything as it would be relying on functions that Linux does not supply.
  I mean, im sure HJT runs fine under Wine, but Ill bet the scan comes up empty every time.
11. Re:Java trapped by eldorel · 2012-02-19 11:08 · Score: 2
  
  I hate to feed the troll, but people reading this thread might not be aware of this.
  
  FACT: Attempting to clean a virus with the same os it was designed to infect is NOT a good idea.
  
  There are a lot of viruses that are designed to exploit things like malformed shortcut files, bugs in the way windows mounts hard drives, or even bugs in the code that checks for the amount of free space on a drive. Ref:(google: "lnk exploit")
  
  If you connect a drive infected with one of these viruses to a windows computer, it WILL get infected.
  
  Most of the examples I gave have been hotfixed via windows update, but new exploits are discovered daily.
  
  Move the drive to a different system, scan using live cds or a write protected linux drive, and flash the bios of the original pc.
  Otherwise you run the risk of the virus infecting your cleanup system.
12. Re:Java trapped by jackbird · 2012-02-19 16:33 · Score: 2
  
  Then you boot from a windows repair DVD that you burned from an ISO downloaded from Microsoft, open a shell, and type either fixmbr \device\harddisk0 or bootrec /fixmbr to overwrite the boot sector with a good one. Then you can at least trust the boot sector.
13. Re:Java trapped by Voyager529 · 2012-02-19 17:22 · Score: 1
  
  To be honest, I too questioned that a smidge, given that the UBCD4Win project distributes a builder that requires a Windows CD to work, whereas Hiren distributes an ISO. While common sense says "if you have an XP disc for the purpose you've fulfilled the legal requirements", especially if you also have a hosed hard disk that carries a licensed copy of Windows requiring disinfecting, it'd be down to a group of lawyers to determine whether it's entirely legal or not.
  What I was referring to was the fact that the older editions included a laundry list of commercial software, such as Norton Ghost, PowerQuest Drive Image, Acronis Disk Director, and plenty more. The project has more recently opted to contain exclusively freeware/shareware/FOSS titles instead.
14. Re:Java trapped by Robert+Zenz · 2012-02-19 20:29 · Score: 1
  
  Sure, do you have a 120 bucks for me?
15. Re:Java trapped by LordLimecat · 2012-02-19 23:59 · Score: 2
  
  Because its goal is to scan said proprietary platform, using said proprietary platform's system files?
  Im not seeing the problem here. It was written for windows, using Windows APIs, to scan the Windows registry, using a MS programming language.
  Do you really have the nerve to ask them to rewrite the whole thing in Java or C++, and also would you please re-implement all the registry and NTFS APIs so that it can run from Linux? How bout everyone be greatful that we have some source, instead of being whiney OSS fanatics?
16. Re:Java trapped by Kalriath · 2012-02-20 09:13 · Score: 1
  
  Hiren's Boot CD (That are now pirated-software free)
  No they're not. Windows PE is only licensed for use with approved software under a contract arrangement with Microsoft. Hiren's Boot CD is not one of them, hence the Windows environment used on Hiren's CD is pirated.
  
  --
  For a site about things like basic rights, Slashdot users sure do like to censor "dissent".
17. Re:Java trapped by Kalriath · 2012-02-20 09:14 · Score: 1
  
  Considering it's designed to clean up problems specifically on that proprietary platform, I don't see that as an issue at all.
  
  --
  For a site about things like basic rights, Slashdot users sure do like to censor "dissent".
Not just for helpdesk and your family by ReallyEvilCanine · 2012-02-19 05:58 · Score: 5, Interesting

Hijacjk This ain't jsut for helpdesk monkeys; we use it constantly in Enterprise software testing. Server works fine, Client works fine, OS checks out, software ain't working. Run HT and find the culprit pretty quickly, and when your customers are telcos and banks doing short-cycle upgrades for occasionally legit reasons, your on-site guys need to find fast answers.
1. Re:Not just for helpdesk and your family by DigiShaman · 2012-02-19 06:28 · Score: 4, Informative
  
  I prefer Autoruns, Process Explorer, and Process Monitor.
  Short of nuke and paving the machine, I can clean up even the most foul and neglected of servers and workstations. Sometimes it's just more cost effective to replace it with a new one including data migration. YMMV.
  http://technet.microsoft.com/en-us/sysinternals/bb545027
  
  --
  Life is not for the lazy.
2. Re:Not just for helpdesk and your family by LordLimecat · 2012-02-19 08:08 · Score: 2
  
  Second. HJT was replaced by the Sysinternals top 3 (Autoruns, ProcessExplorer, Process Monitor) about the time TrendMicro acquired it and stopped maintaining it.
  It was useful for some things, but Autoruns very quickly surpassed it, and virus removal (what HJT was supposedly better at) wasnt really doable once advanced rootkits started appearing around that time and HJT took no countermeasures.
  Autoruns is also a lot better laid out, and is constantly updated with new features.
3. Re:Not just for helpdesk and your family by ReallyEvilCanine · 2012-02-19 08:27 · Score: 3, Interesting
  
  I love SysInternals and have the original Winternals files on an old 3.2 SCSI-II somewhere (or maybe buried somewhere in a /win//utils/OS/win directory on my server). Run as many SysInternals as you want and find me the BHO that's preventing an ActiveX control from passing info through a hidden helper browser window. You can sit all day with Proc* looking for that. I want to find a bad thread or spin or memleak, yeah, SysInternals all the way.
  HT is by no means dead; you can spend a lot of extra time putting a screw through a board with a hammer but a screwdriver is probably the better and more efficient choice for the job.
4. Re:Not just for helpdesk and your family by Trax3001BBS · 2012-02-19 09:27 · Score: 2
  
  Oh ya I'm on top of www.SysInternals.com became a fan with Process Explorer.
  Sysinternals Suite is in my path as I find Process Monitor very helpful as well as WHOIS.
  I've found with WinXP and below at least. if you run process monitor (log) and get a blueScreenOfDeath
  searching the log for faultrep.dll -your problem is just lines above it (depending upon your filters).
  But I also use Hijackthis and have suggested it to a lot of people in my time on alt.24hoursupport.helpdesk
  It's a down and dirty way of seeing how things look, I'll run it every so often then paste the results
  to http://hijackthis.de/en bypassing the need to log in to Trend Micro.
5. Re:Not just for helpdesk and your family by Krneki · 2012-02-19 22:34 · Score: 1
  
  I agree with you, but I still use Hijackthis, even if the time has passed and it's not that useful as it was on Windows XP.
  
  --
  Love many, trust a few, do harm to none.
6. Re:Not just for helpdesk and your family by antdude · 2012-02-20 14:42 · Score: 1
  
  http://www.nirsoft.net/ is also pretty good with its utilities.
  
  --
  Ant(Dude) @ Quality Foraged Links (AQFL.net) & The Ant Farm (antfarm.ma.cx / antfarm.home.dhs.org).
I'd be interested... by Okomokochoko · 2012-02-19 06:07 · Score: 1

...to see how HJT does what it does (in source). AFAIK, it's one of the better tools for finding things that get missed by most AV packages. Dangerous but comprehensive.
1. Re:I'd be interested... by Lehk228 · 2012-02-19 06:32 · Score: 1
  
  How it works is pretty clear from it's output and how it categorizes it's output, rather than scanning the whole system it looks at all the places code malicious configuration can hook into windows and lists all items using those hooks, it does not evaluate said items for badness, which makes it very powerful and useful, it can just as easilly clean up a benign but botched install or botched uninstall that is still partially loading. Honestly microsoft should have acquired it and made it part of task manager or msconfig
  
  --
  Snowden and Manning are heroes.
Many thanks to HijackThis's creator! by acidradio · 2012-02-19 06:18 · Score: 3, Insightful

I think the IT world collectively owes Merijn Bellekom some beers. Think about how many of us his tool has helped out over the years!
Auto detect? by Anonymous Coward · 2012-02-19 06:20 · Score: 2

I would like so much to have an HijackThis that runs after every program installation (and possibly every hour) that warns me each time my configuration has changed, just to know that something fishy has possibly happened.
1. Re:Auto detect? by leuk_he · 2012-02-19 09:38 · Score: 1
  
  That is the whole issue with using a power tool like hijackthis. Define "fishy". Besides that, you are too late after the fact. With rootkits nowadays you only find 95% of the evil stuff.
  You need some virtualisation/sandboxing/fine grained access list to have an early warning system.
  Fixing after the fact is the same as system restore in windows....
2. Re:Auto detect? by tokul · 2012-02-19 18:39 · Score: 1
  
  Search for SpyBot Search and Destroy in your favorite search engine and check TeaTime manual.
Re:Which license, bitches? by liamevo · 2012-02-19 06:21 · Score: 5, Informative

http://sourceforge.net/projects/hjt/ /me looks under license /me looks at you
Was that hard?
Easy enough to port to a faster language then by Anonymous Coward · 2012-02-19 06:28 · Score: 1

Like Borland Delphi, AND, that said? 64-bit ports are easy too (Delphi XE2).
* The reason I note this, is that this program, like so many others like it, read the registry (for malware traces, doubtless based on a single C/C++ style structure/Pascal-Object Pascal record variable that holds the signatures to look for so they can all be treated as a SINGLE variable whose elements get parsed & compared to a registry entry scanned...), and filesystems.
(No, I haven't SEEN the sourcecode, but I wager that's how it's done for efficiency's sake)...
Nice part is, that you'd end up with a faster program than VB yields as well (double bonus), AND, a 64-bit port's SIMPLE in Delphi (easier than any other language imo, that's not runtime interpreted that is - though you have that option in Delphi XE2 also (.NET)).
My guess is that it's a "Find First-Find Next" read of disks/files/folders AND registry entries for the most part (not a hell of a lot to learn & use really, once you "get the hang of it" in Win32/64)... but, that's just a guess (on how I'd design such a tool @ least).
APK
P.S.=> Porting VB to Delphi's pretty easy, and same with C++ to Delphi (or, vice-a-versa in both cases), so... there you are!
...apk
1. Re:Easy enough to port to a faster language then by DMFNR · 2012-02-19 14:28 · Score: 1
  
  Chances are if the open source community choose to rewrite this they probably wouldn't choose another locked in proprietary language to do it. One way to ensure failure for a FOSS project is to use a language that people would have to pay to use. Kind of silly to have to pay hundreds of dollars to be able to develop free software for no pay. Also, far more developers are skilled with a language like C++ than Delphi these days. I have nothing against Delphi or the Object Pascal language, hell there's even a pretty decent open source implementation in FPC / Lazarus, but it is almost never the right tool if you want to grow an open source project.
The reason I noted doing a 64-bit port... by Anonymous Coward · 2012-02-19 06:33 · Score: 1

Is that a 32-bit program does NOT have "full" registry hives access in 64-bit systems... hence, possibly WHY a 64-bit port's a GOOD idea - for now though? As long as malwares do NOT go "64-bit" as well?? 32-bit CAN & WILL "do the job"... for now, that is.
APK
P.S.=> Am I interested in this? No... got plenty of code to work on here myself, but it's worth pointing out for those who MAY indeed, be interested in this... apk
1. Re:The reason I noted doing a 64-bit port... by LordLimecat · 2012-02-19 08:05 · Score: 1
  
  Not an expert on this, but a program does not need to be 64-bit to access all parts of the registry, it just needs to be able to call another program that DOES have access to those parts. Theres no reason I couldnt write a 32-bit program which calls "reg query HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node" in order to get its results.
A second vote for Russinovich's tools by Sycraft-fu · 2012-02-19 07:10 · Score: 2

I always used to say "These are so useful, MS should buy them and make them official." Well, they did. They are top notch for when you need to do some finer diagnosis on what is going on with a system.
I also pull them out when I have some old software that refuses to run without being an admin. By monitoring file access, registry access, and so on I have always been able to find out what it needs to run deprivileged.
1. Re:A second vote for Russinovich's tools by fluffy99 · 2012-02-19 17:17 · Score: 1
  
  I always used to say "These are so useful, MS should buy them and make them official." Well, they did. They are top notch for when you need to do some finer diagnosis on what is going on with a system.
  I also pull them out when I have some old software that refuses to run without being an admin. By monitoring file access, registry access, and so on I have always been able to find out what it needs to run deprivileged.
  They also got the author, Mark Russinovich, who knew the ins and out of some of the MS internals better then Microsoft themselves.
  Yes, the sysinternals stuff really kicks butt.
Another unit test for the malware writers by gringer · 2012-02-19 09:23 · Score: 1

If they aren't already doing this, an open source product should make it a bit easier for the malware writers to test out how well hidden their product is (or how closely it represents the noise experienced during a normal day of computing).

--
Ask me about repetitive DNA
Registry by tepples · 2012-02-19 11:23 · Score: 1

You could always get a life, realize that operating systems are not the end all of existence, and use a Windows machine to scan the hard drive.
True, but why does mounting a USB hard drive read-only require modifying the registry?
1. Re:Registry by fluffy99 · 2012-02-19 17:10 · Score: 1
  
  True, but why does mounting a USB hard drive read-only require modifying the registry?
  Because 99.9999% of the users never have any desire to mount anything other than read/write.
  I wrote a little app that toggles this registry setting back-n-forth. It's in the startup on all our machines containing sensitive data. By default all the usb stuff gets mounted read-only. If you want to write to it, you need to run the app prior to plugging it in to temporarily allow read-write mounting. (Yes I realize it's not a foolproof solution, but it does add some protection against accidental data spillage and virus propagation via thumb drives). The registry setting only comes into play at the time the device is mounted. Changing it after something is mounted only affects how future devices are mounted.
Visual Fred by tepples · 2012-02-19 11:27 · Score: 1

Didn't Microsoft once provide a translation tool useful for porting a Visual Basic application to VB.NET, not unlike what the Python Software Foundation would later provide around the 2.6 days?
1. Re:Visual Fred by JourneymanMereel · 2012-02-23 07:38 · Score: 1
  
  Yep... it was called Visual Basic.Net ... I haven't tried in the newer versions, but the first VB.Net (2005 was it?) did a pretty horrid job with my relatively small VB 6 apps. I actually ended up just re-writing them all.
  
  --
  Life has many choices. Eternity has two. What's yours?
Separate service to read the registry by tepples · 2012-02-19 11:30 · Score: 1

it would be rather like expecting The Gimp to implement ext4 read / write functions so that one can launch it under windows and access files on a Linux FS
You're right. A better idea is to implement a network redirector service and point GIMP at its drive letter. Likewise, a port of HJT to Linux might include a way to read registries other than that of the boot volume, possibly relying on a separate service to interpret the NT hive files.
Re:Maybe I'm stupid or something... by Spacejock · 2012-02-19 17:49 · Score: 1

Click on the Code tab and it'll give you the subversion command to download the source tree. You can also grab a tarball from this page: http://hjt.svn.sourceforge.net/viewvc/hjt/

And while I'm commenting ... as a VB programmer going way back to QB45, GFA Basic on the Atari, and Sinclair Basic on the Spectrum, it'll be nice to finally be able to download and play with the source for one of these utils.

--
Hal Spacejock: Science Fiction with Nuts