Trend Micro HijackThis is a free utility that generates an in depth report of registry and file settings from your computer. HijackThis makes no separation between safe and unsafe settings in its scan results giving you the ability to selectively remove items from your machine. In addition to this scan and remove capability HijackThis comes with several tools useful in manually removing malware from a computer.

IMPORTANT: HijackThis does not determine what is good or bad. Do not make any changes to your computer settings unless you are an expert computer user.

Advanced users can use HijackThis to remove unwanted settings or files.

Using HijackThis

To analyze your computer, start HijackThis and run a scan. See the Quick Start Guide [link to Quick Start, FAQs and Feedback] for help in running a scan. HijackThis will display a list of areas on your computer that might have been changed by spyware. Do not change any settings if you are unsure of what to do. There are many popular support forums on the web that provide free technical assistance by using HijackThis log files to diagnose an infected computer.

Not an expert? Just save the HijackThis report and let a friend with more troubleshooting experience take a look. A large community of users participates in online forums, where experts help interpret HijackThis scan results to clean up infected computers.

Operating System

• Microsoft™ Windows™ XP
• Microsoft™ Windows™ 2000
• Microsoft™ Windows™ Me
• Microsoft™ Windows™ 98
• Microsoft™ Windows™ Vista
• Microsoft™ Windows™ 7

Software

• Microsoft Internet Explorer 6.0 or newer
• Mozilla™ Firefox™ 1.5 or newer

Feedback

Although Trend Micro does not provide free technical support for HijackThis, we do encourage you to provide your feedback and suggestions regarding your experience with this free tool.

Download full FAQs

Frequently Asked Questions

• What does HijackThis do?
• How do I generate a log file?
• How do I generate a startup list log file?
• What can I do with a HijackThis log file?
• How do I use the Process Manager?
• How does the Ignorelist work?
• What does the Fix Checked button do?
• What information will "Info on selected item" provide me?
• How do I restore items I have mistakenly deleted?
• Why do I receive an 'Unexpected error' about a missing DLL when running HijackThis?
• Why does HijackThis immediately close when I try to run the utility?
• Can I contact Trend Micro for technical support on HijackThis?

What does HijackThis do?

HijackThis inspects your computer’s browser and operating system settings to generate a log file of the current state of your computer. Using HijackThis you can selectively remove unwanted settings and files from your computer. Because the settings identified in a HijackThis log file can belong to both legitimate software and unwanted malware it is important to use extreme caution when selecting to remove anything using HijackThis.

How do I generate a log file?

If you have not already done so download and install HijackThis:
Installer | Executable

• Once installed open HijackThis by clicking Start > Programs > HijackThis and click the button labeled "Do a system scan only"


• Click the scan button in the lower left hand corner of the interface and HijackThis will quickly scan your system.


• Once the scan is complete the scan button will now read "save log". Click this button to save the log file to your PC. Once you select where you would like to save the file it will open in your systems default text editor. Typically this application is Notepad.

How do I generate a startup list log file?

Open HijackThis by clicking Start > Program Files > HijackThis > HijackThis.exe

• Click the "Open the Misc Tools section" button


• Click the "Generate StartupList log" button and a warning box will appear.


• Once you click ok to this warning the log will open in your systems default text editor.

What can I do with a HijackThis log file?

Once you have generated a log you can analyze the results to identify what settings have been made by malware. The web offers a wealth of resources outside of TrendSecure that can help you interpret your log file results and help you manually clean your system of malware.

A common practice is for a novice user to generate a log file and provide the log file generated on their PC to a forum where malware experts provide information how to clean up the infection.

Use the Analyze This link to find forums that provide assistance with HijackThis log files.

How do I use the Process Manager?

The Process Manager will list all open processes running on your machine. You can then click once on a process to select it, and then click on the Kill Process button. This will attempt to end the process running on the computer.

If you would like to terminate multiple processes at the same time, press and hold down the control key on your keyboard. While that key is pressed, click once on each process that you want to be terminated. As long as you hold down the control button while selecting the additional processes, you
will be able to select multiple processes at one time. When you have selected all the processes you would like to terminate you would then press the Kill Process button.

If you would like to see what DLLs are loaded in a selected process, you can put a checkmark in the box labeled Show DLLs, designated by the blue box in the figure above. This will split the process screen into two sections. The first section will list the processes like before, but now when you click on a particular process, the bottom section will list the DLLs loaded in that process. To exit the process manager you need to click on the back button twice which will place you at the main screen.

How does the Ignorelist work?

The Ignorelist displays a list of items selected to be ignored during a HijackThis scan. Item(s) may be to be ignored may be deleted from this list by selecting the item(s) and click Delete or Delete all.

What does the Fix Checked button do?

The Fix Check button allows you to remove items from your system that in the scan results list. Select the item(s) to be removed and click Fix Checked You will be prompted to confirm your selection choose Yes or No.

** Please use caution when removing items **

What information will "Info on selected item" provide me?

The results of your HijackThis scan will be display a list of items found by the program. To get more information on particular items select the item(s) and click the "Info on selected item" button.

How do I restore items I have mistakenly deleted?

Open HijackThis and click the "Open the Misc Tools section" button. Click on the "Backups" button at the top of the interface.

A list of settings that you have removed with HijackThis will appear. Select the setting that you would like to restore and click the "Restore" button.

Why do I receive an 'Unexpected error' about a missing DLL when running HijackThis?

HijackThis requires the Visual Basic Runtime Libraries in order to run. Some older versions of Windows may require you to install these libraries. These can be downloaded from Microsoft at the following URL: download.microsoft.com/download/vb60pro/Redist/sp5/WIN98Me/ENUS/vbrun60sp5.exe

Why does HijackThis immediately close when I try to run the utility?

Some variants of malware have been known to force HijackThis to exit as soon as you open the program. If this is happening on your PC you should try renaming HijackThis. For example change HijackThis.exe to Hijack.exe this should allow you to run HijackThis once again.

Can I contact Trend Micro for technical support on HijackThis?

Trend Micro recognizes that several security communities use HijackThis log files to help users evaluate and eradicate infections. Trend Micro recommends that you show your HijackThis log file and/or AnalyzeThis results to knowledgeable folks. While we welcome your feedback, Trend Micro does not provide technical support for HijackThis and its other freeware utilities.

Download full Quick Start Guide

Getting Started

1. Download and install HijackThis. You will need to download both the Installer and Executable files.
   1. Download Installer (See links above)
   2. Download Executable (See links above)
   
   
2. Once installed, open HijackThis by clicking Start > Program Files > HijackThis and click the button labeled "Do a system scan only".


3. Once the scan is complete, click the AnalyzeThis button. A web page will open containing helpful information regarding HijackThis.
   Note: Once the scan is complete, the scan button will read "Save log". You may save the log file to your PC. Once you select where you would like to save the file, it will open in your system's default text editor. Typically this application is Notepad.

How to generate a startup list log file

1. Open HijackThis by clicking Start > Program Files > HijackThis > HijackThis.
2. Click the "Open the Misc Tools section" button.
3. Click the "Generate StartupList log" button and a warning box will appear.
4. Once you click "Yes" to continue, the log will open in your system's default text editor.

Common log file uses

Once you have generated a log you can analyze the results to identify what settings have been made by malware. The web offers a wealth of resources outside of TrendSecure that can help you interpret your log file results and help you manually clean your system of malware.
A common practice for novice users is to generate a HijackThis log file and submit it one of the many forums devoted to HijackThis on the web. Experts at these forums provide information on which items are causing your problems and how to remove them safely from your computer.

Feedback/Support policy

Trend Micro recognizes that several security communities use HijackThis log files to help users evaluate and eradicate infections. Trend Micro recommends that you show your HijackThis log file and/or AnalyzeThis results to knowledgeable folks. While we welcome your feedback, Trend Micro does not provide technical support for HijackThis and its other freeware utilities.