You are here

Home » Forums » Development Forums » Beta Testing

[Released] HiJackThis Portable 2.0.4 Development Test 3

20 posts / 0 new
Log in or register to post comments
Last post
February 21, 2012 - 1:59am
#1
scriptdaemon
Offline
Last seen: 3 years 4 months ago
Developer
Joined: 2008-10-10 17:40
[Released] HiJackThis Portable 2.0.4 Development Test 3

Application: HiJackThis
Category: Security
Description:

HijackThis is a free utility that generates an in depth report of registry and file settings from your computer. HijackThis makes no separation between safe and unsafe settings in its scan results giving you the ability to selectively remove items from your machine. In addition to this scan and remove capability HijackThis comes with several tools useful in manually removing malware from a computer.

IMPORTANT: HijackThis does not determine what is good or bad. Do not make any changes to your computer settings unless you are an expert computer user.

Advanced users can use HijackThis to remove unwanted settings or files.

Download HiJackThis Portable 2.0.4 Development Test 3 [704KB download / 669KB installed]
(MD5: 0ee6e5341a41d6f1c7fd4907d4518ada)

Release Notes:
2.0.4 Development Test 3 (2012-03-07)

  • Fixed empty registry key not being removed properly

2.0.4 Development Test 2 (2012-03-03)

  • Fixed registry keys not being backed up properly

2.0.4 Development Test 1 (2012-02-20): Initial release

Top
February 21, 2012 - 2:19am
bill_gagliardi
bill_gagliardi's picture
Offline
Last seen: 10 months 2 weeks ago
Joined: 2008-11-05 22:44
looks good

Tested it out briefly on my WinXP SP3 system. Worked like a charm. Will be giving it a good workout tomorrow on a sick system...

Bill G.
Frozen St. Paul, MN
land of the frozen mosquito

Top
February 21, 2012 - 2:16pm
depp.jones
Offline
Last seen: 2 hours 14 min ago
DeveloperTranslator
Joined: 2010-06-05 17:19
Nice!

Another external app to be kicked out of the list. The startup time of my toolbox drive is decreased again. Wink
Works like a charm. I just found the added functionality in the options box and realized how long ago I last had to use it seriously (right before trendmicro took over I think).

Top
February 22, 2012 - 2:00am
dwebb5
Offline
Last seen: 3 weeks 3 days ago
Joined: 2009-01-06 01:04
Oh yeah!

This should be handy.
I have only had to use this twice, when NOTHING else worked!
Thanks for making it portable. I'll check it out.

Top
February 29, 2012 - 3:18pm
nightbeholder
Offline
Last seen: 9 years 10 months ago
Joined: 2007-10-28 00:39
Did a quick testing on a VM

Did a quick testing on a VM with w7x64 and it seems to be saving the settings in:
HKLM\SOFTWARE\TrendMicro\HijackThis

Top
March 2, 2012 - 8:59pm
(Reply to #5)
scriptdaemon
Offline
Last seen: 3 years 4 months ago
Developer
Joined: 2008-10-10 17:40
Yes.

The launcher should be properly backing this key up. Is it not for you?

Top
March 3, 2012 - 8:22pm
(Reply to #6)
nightbeholder
Offline
Last seen: 9 years 10 months ago
Joined: 2007-10-28 00:39
Nope Here's the relevant

Nope Sad
Here's the relevant stuff it is living behind (after changing a couple of options and doing a quick scan before closing the program):

----------------------------------
Keys added:2
----------------------------------
HKLM\SOFTWARE\TrendMicro
HKLM\SOFTWARE\TrendMicro\HijackThis

----------------------------------
Values added:13
----------------------------------
HKLM\SOFTWARE\TrendMicro\HijackThis\IgnoreNum: "0"
HKLM\SOFTWARE\TrendMicro\HijackThis\AutoSelect: "0"
HKLM\SOFTWARE\TrendMicro\HijackThis\Confirm: "1"
HKLM\SOFTWARE\TrendMicro\HijackThis\MakeBackup: "1"
HKLM\SOFTWARE\TrendMicro\HijackThis\IgnoreSafe: "1"
HKLM\SOFTWARE\TrendMicro\HijackThis\LogProcesses: "1"
HKLM\SOFTWARE\TrendMicro\HijackThis\ShowIntroFrame: "1"
HKLM\SOFTWARE\TrendMicro\HijackThis\DefStartPage: "http://www.msn.com/"
HKLM\SOFTWARE\TrendMicro\HijackThis\DefSearchPage: "http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
HKLM\SOFTWARE\TrendMicro\HijackThis\DefSearchAss: "http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm"
HKLM\SOFTWARE\TrendMicro\HijackThis\DefSearchCust: "http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm"
HKLM\SOFTWARE\TrendMicro\HijackThis\WinHeight: "8000"
HKLM\SOFTWARE\TrendMicro\HijackThis\WinWidth: "9000"
Top
March 3, 2012 - 9:14pm
(Reply to #7)
vf2nsr
vf2nsr's picture
Offline
Last seen: 6 years 5 months ago
Developer
Joined: 2010-02-13 17:10
FYI

While program is running this would be normal. You need to close the program and then run the regshot. As the launcher cleans up those after closing the program

“Be who you are and say what you feel because those who mind don't matter and those who matter don't mind.” Dr. Seuss

Top
March 3, 2012 - 9:23pm
(Reply to #8)
nightbeholder
Offline
Last seen: 9 years 10 months ago
Joined: 2007-10-28 00:39
I know how to test an app

I know how to test an app with regshot Blum
Does it clean everything for you?

Top
March 3, 2012 - 11:51pm
(Reply to #9)
vf2nsr
vf2nsr's picture
Offline
Last seen: 6 years 5 months ago
Developer
Joined: 2010-02-13 17:10
My Appologies

I saw you say you did the regshot without closing the program yet so assumed that the keys were still there because the program was still running and had not had a chance to "cleanup". No offense was meant

“Be who you are and say what you feel because those who mind don't matter and those who matter don't mind.” Dr. Seuss

Top
March 5, 2012 - 1:29pm
(Reply to #10)
nightbeholder
Offline
Last seen: 9 years 10 months ago
Joined: 2007-10-28 00:39
all good

all good
Yeah I guess that could have been misinterpreted. But yea, I took the regshot after closing the program Smile

Top
March 3, 2012 - 9:26pm
(Reply to #11)
Ken Herbert
Ken Herbert's picture
Offline
Last seen: 5 hours 8 min ago
DeveloperModerator
Joined: 2010-05-25 18:19
Same for me (different keys,

Same for me (different keys, a few less keys, but I just started and closed the app).

Your launcher.ini is cleaning up HKLM\Software\Trend Micro, but these keys are in HKLM\Software\TrendMicro without the space. Typo, or are there other keys stored under HKLM\Software\Trend Micro as well?

Top
March 3, 2012 - 9:40pm
(Reply to #12)
scriptdaemon
Offline
Last seen: 3 years 4 months ago
Developer
Joined: 2008-10-10 17:40
Fixed.

Fixed.

Top
March 5, 2012 - 1:24pm
(Reply to #13)
nightbeholder
Offline
Last seen: 9 years 10 months ago
Joined: 2007-10-28 00:39
I don't know why but it's

I don't know why but it's still not saving any settings I change... Maybe someone else could test it too?

BTW, in my main x64 system it saves entries to the registry in
HKLM\SOFTWARE\Wow6432Node\TrendMicro\HijackThis
instead of
HKLM\Software\TrendMicro\HiJackThis

Also, you should make it clean the whole "...\TrendMicro" instead of just the "...\TrendMicro\HijackThis", or the previous will still stay in the registry

sorry if i'm sounding annoying, just trying to help Biggrin

Top
March 5, 2012 - 3:45pm
(Reply to #14)
scriptdaemon
Offline
Last seen: 3 years 4 months ago
Developer
Joined: 2008-10-10 17:40
Hm.

I'll look into this further. As for the HKLM\Software\TrendMicro, I may have forgotten to remove that key if it is empty. In cases such as this, I save from HKLM\Software\PUBLISHER\PROGRAM then delete HKLM\Software\PUBLISHER if it's empty.

Top
March 8, 2012 - 12:00am
(Reply to #15)
scriptdaemon
Offline
Last seen: 3 years 4 months ago
Developer
Joined: 2008-10-10 17:40
.

I fixed it leaving behind an empty HKLM\Software\Trend Micro.

Though, I cannot seem to reproduce your other issue with keys being left behind in HKLM\SOFTWARE\Wow6432Node\TrendMicro\HijackThis. Can you provide the steps you used when using HJT?

Top
March 8, 2012 - 12:14am
(Reply to #16)
John T. Haller
John T. Haller's picture
Online
Last seen: 34 min 37 sec ago
AdminDeveloperModeratorTranslator
Joined: 2005-11-28 22:21
Same

Wow6432Node is used for 32-bit apps operating on a 64-bit OS in place of the key without that part of it.

Sometimes, the impossible can become possible, if you're awesome!

Top
March 9, 2012 - 12:29am
(Reply to #17)
nightbeholder
Offline
Last seen: 9 years 10 months ago
Joined: 2007-10-28 00:39
About the Wow6432Node it's

About the Wow6432Node it's what John said, although I'm not sure why it is saving that entry in my main windows installation and not in the VM (they are both win7x64)

About the Software\TrendMicro issue, all clean now after using

thanks for making this one portable

Top
November 17, 2012 - 6:38pm
Gord Caswell
Gord Caswell's picture
Offline
Last seen: 2 days 17 hours ago
DeveloperModerator
Joined: 2008-07-24 18:46
Clean

Looks clean to me, the appinfo.ini version just needs to be bumped to 3.0 prior to release.

Suggestion: Since it isn't possible to pass files to this app (can you?), you might consider setting RunAsAdmin to compile-force.

Top
November 18, 2012 - 2:38am
(Reply to #19)
scriptdaemon
Offline
Last seen: 3 years 4 months ago
Developer
Joined: 2008-10-10 17:40
.

Are you saying the base app has the functionality to pass files to it, but the portable version does not?

If not, isn't compile-force only for use when force does not work? Or am I not understand your suggestion?

Top
Log in or register to post comments