HJT: List of updates

[dragokas]

Here we'll public most recent HiJackThis Fork updates list.

If you want to test (experimental) version that is usually coming before actual pushing the source code, you can download nightly build by this link: https://dragokas.com/tools/HiJackThis_test.zip

---

For the full history (since v.2.6.1.0 Alpha Fork) - Oct 12, 2015 based on official v2.0.6, see: HiJackThis menu "Help" -> "About HJT" -> "History", or ./src/_ChangeLog_en.txt file. Russian version is here.

[dragokas]

[2.10.0.6 beta] (Nightly) - Feb 12, 2021

• Fixed: HJT uninstallation removes not all keys.
• Fixed: Explorer is restarted in 'Limited Mode' after O21 Fix.
• Fixed: O26 - Tools false positives.
• Hotkeys: 'Ctrl' + 'Mouse Wheel' to change the font size of results window list.
• More optimizations.

[dragokas]

[2.10.0.7 beta] (Nightly) - Feb 20, 2021

• Added new 'Files Unlocker' tool (see 'Tools' menu => Files => Unlock File / Folder).
• Global code clear and optimization (thanks to LaVolpe and his 'Project Scaner' tool).
• Some errors are fixed.
• Improved source code building script.

[dragokas]

[2.10.0.8 beta] (Nightly) - Mar 16, 2021

• More code clear.
• Improved filter of O22 - Bits whitelists.

[dragokas]

[2.10.0.9]

• Moved status to a stable release.
• O26 - Fixed false "file missing".
• O7 Policy - Added more keys for detection DisableTaskMgr.

[dragokas]

[2.10.0.10] - Oct 14, 2021

• Added detection of Windows 11, Windows Server 2019, Windows Server 2022.
• Added DisplayVersion in addition to ReleseId where possible.
• O22 - Tasks: whitelists are updated.

[dragokas]

[2.10.0.11] - Nov 21, 2021

• Improved error logging.

[dragokas]

[2.10.0.12] - Nov 23, 2021

• Updated MS certificates list.

[dragokas]

[2.10.0.13] - Dec 02, 2021

• Fixed potential crash related to bad buffer size in codepage encoder (thanks to @thetrik for letting me know).
• Fixed missing translation.
• Fixed font size on some controls.
• [Updates checker] Corrected error code returned.
• System errors description are now displayed on selected language.
• [Uninstall manager] Fixed double-unicode in registry snapshot report on some locales.

[dragokas]

[2.10.0.14] - Dec 26, 2021

• O22 - BITS: Fixed throwing error when URL is missing (thanks to @Sandor-Helper for report).
• Certificates are updated.

[dragokas]

[2.10.0.16] - Jan 12, 2022

• Added Spanish translation (thanks to Andago).
• Added key /LangSP - force use Spanish language for user interface.
• Corrected size of the forms for better match the translation.
• Minor edits of RU/UA/FR translations.
• Updated Merijn Bellekom donation link in StartupList tool.
• StartupList (and HJT): fixed "Show file" context menu didn't work with System32 files.

[mrbellek]

Nice work! 😃

[dragokas]

[2.10.0.17] - Apr 07, 2022

• Added new Microsoft certificates.
• Files unlocker: Added buttons "Add File(s) / Folder(s)".

[dragokas]

[2.10.0.18] - May 28, 2022

• Returned missing buttons in Uninstall Manager ^^
• Fixed broken functionality of 01 - Hosts (thanks to Boxersteavee for report).
• Improved Hosts file read speed.
• Improved registry export speed.
• [Backup] CRC32 calculation speed and reliability are improved.

[dragokas]

[2.10.0.19] - Jul 24, 2022

• Whitelist services is updated.
• Some adjustment in O4 to show "(Microsoft)" postfix for more cases.
• O22 - Tasks_Migrated: Added detection of migrated tasks in Windows 11.
• O22 - Tasks: Added detection of tasks in SysWow64.
• O22 - Tasks: fixed incorrect decoding of non-English characters by xml parser.

[dragokas]

[2.10.0.20] - Aug 02, 2022

• Several AppLocker fixes are done (thanks to regist for report, analytics and support):
• O7 - AppLocker: Added detection of "ManagedInstaller" rule.
• O7 - AppLocker: Fixed hash-based rule displayed one record instead of multiple.
• O7 - Applocker: Improved "Fix all" procedure.

[dragokas]

[2.10.0.21] - Aug 28, 2022

• Added free memory info and total CPU loading *.

  loading data may be overestimated on weak processors.

• Cut down icon metadata causing false positive detection by Yara rules (VT).
• Fixed Hosts template and its ACL permissions according to reference.
• O22 - Added -32 prefixes for 32-bit tasks on 64-bit OS.
• Tools=>Unlock file/folder: Improved recurvive procedure of reset permissions.

[dragokas]

[2.10.0.22] - Aug 29, 2022

• Digital Signature Checker Tool: New buttons "Add folder", "Clear list".
• Translation corrected.

[dragokas]

[2.10.0.23] - Sep 03, 2022

• Context menu: Added button "Copy" - "File Argument".
• Search: Save lastly entered phrase after program exits.
• ADS Spy: fixed functionality of "Browse" button (thanks to Alexyz21 for report).
• Uninstall manager: fixed location of "Remove Software" button.

[dragokas]

[2.10.0.24] - Jan 11, 2023

• Fixed ignore list operation when "Calculate checksum" option is enabled (thanks to Gordon-Dry for the notification).

[dragokas]

[2.10.0.25] - Jan 14, 2023

• Fixed freeze while fixing O7 - TroubleShooting: (EV).
• Whitelists Windows 11 has been updated.
• Added detection of Windows Defender policies and restoring AMSI providers.

[dragokas]

[2.10.0.26] - Feb 13, 2023

• Fixed system reboot on Windows 11.

[dragokas]

[2.10.0.28] - Mar 02, 2023

• Fixed progress bar bug (thanks to @Yashil06 for report).

[dragokas]

[2.10.0.29] - Apr 14, 2023

• Added O7 - AutoLogon.
• O7 - TroubleShooting (EV): [PathExt] and [PSModulePath] moved to "Missing list" method, which means item is displayed if only system defaults missing.
• Fixed Timer class overflow (thanks to Mikle Quits).
• Fixed "Search on Google".
• Some speed optimizations.

[dragokas]

[2.10.0.31] - May 06, 2023

• Fixed potential error in retrieving paths of executable images on Windows 8.1- due to OS bug (thanks to HackerVlad).
• TamperProtection will show an error code instead of the number 0 if an access is denied.
• Fixed freezing for 15 seconds on Windows 10+ when checking BITS.

[dragokas]

[3.0.0.1 Alpha] - May 26, 2023

• F*ck them all, manifest is on github: https://github.com/dragokas/hijackthis
• No f*cking release General:
  • Renamed program to HiJackThis+ (Plus) to refer to a specific product without confusion with other forks:
  • smooth transition from stand-alone exe version to multi-file version is planned
  • the program can no longer be launched from the archive directly
  • part of the modules is planned to be ported to C++ code with multithreading
  • Due to violation EU GDPR by the certificate authorities which doesn't want to remove personal data from the certificate, excessive cost, as well as the war in Ukraine, the software certificate will not be renewed:
  • when starting the program, the publisher name will be displayed as "Unknown"
  • the program will be supplied with a self-signed certificate with the name of Alex Dragokas
  • you can manually add this certificate to the Windows root store to continue see the publisher name in the UAC window. Instruction: https://github.com/dragokas/hijackthis/wiki/How-to-add-HiJackThis-root-certificate New:
  • Added section "B" - (Browsers); under development; output/fix of suspicious Google Chrome extensions is currently supported.
  • Added "Registry key type analyzer" tool (you can see symlinks, redirector type (presence of WOW companion and its type: Shared/Reflected/Simple key), virtualization, flags, date, etc.). Would be useful for researchers and developers. Functionality:
• Added new marks:
• "(missing)" - displayed for a missing registry entry (parameter or key).
• "(access denied)" - displayed if there are no access permissions to the object.
• these marks are planned to be extended to work in all sections, however at the moment it only works in O7 [TamperProtection].
• x32 keys ("-32" sections) are displayed with normalized name now (\Wow6432Node\ is specified whenewer the section log record isn't shortened). Can be viewed fully through context menu "Jump". Bugs:
• Fixed Digital Signature Checker: could give incorrect (pre-cached) data for some fields due to faster processing.

[dragokas]

[3.0.0.2 Alpha] - May 29, 2023

• The situation in Ukraine: sirens, sirens, sirens == insomnia.
• "Additional scan" is included in the "default" settings.
• O7 - Taskbar policy: added NoViewContextMenu, NoSecurityTab
• Added display of current user account type: Local/Microsoft/ActiveDirectory/AzureAD/Internet (Windows 8 and above).
• Remove symlink keys (source).
• Better quality of taskbar icon.
• Fixed missing menu icons when selecting a language with unicode characters.
• Support Unicode text for the system menu (no context menu yet).

[dragokas]

[3.0.0.3 Alpha] - June 01, 2023

• Added definition of O7 - Account: UAC
• Added O7 - Policy: *..\Policies\Explorer\DisallowRun: Fix all - fixes all DisallowRun lines at once and sets the DisallowRun parameter to 0.
• Displaying account type in AutoLogon.
• Fixed: SFC wasn't performed for missing system files.
• Fixed: The file name wasn't copied via the context menu if "File missing".
• Fixed: DisallowRun displayed wrong state.
• Improved Regexp in Registry Key Type Checker; fixed bug with field selection.
• Fixed false positives of Additional subsections.
• Fixed mark Boot mode: Safe Boot ("with" or "without network support" is always written).
• Added the DataChecker class, which makes it easier to create definition rules.
• Design change:
  • text format changes
  • Button "None of above, just start the program" renamed to "Settings"
  • Removed the checkbox "Do not show the main menu after starting the program"
  • DPI support for logo

[dragokas]

[3.0.0.4 Alpha] - June 03, 2023

• Added BitsAdmin wait timeout (thanks Sandor)
• Improved compatibility with AutoLogger software (thanks to regist)
• Added new keys to O7 - Policy
• Improved Boot Mode output (displayed only if enabled and supported by hardware and OS):
  • Added Secure Boot state (thanks Kazakevich O.)
  • added Test Signing state
  • added Debug Mode state
  • added Hypervisor enforced Code Integrity (HVCI) state
• Added context menu Copy => File Hash

[dragokas]

[3.0.0.6 Alpha] - June 04, 2023

• Fight against false antivirus detections:
  • Encrypted strings with Windows Defender keys
  • Rollback of CopyBytes optimization because Avira doesn't like this function :(
  • Temporarily moved to legit certificate which almost out-of-date
  • GitHub release link is replaced by static to a stable version 2.x, which will not be updated.

[dragokas]

[3.1.0.1 Alpha] - June 17, 2023

• Added detection of O4 - Active Setup (thanks to regist).
• Added flag (+safe mode) for services and drivers that starts in safe mode.
• Added file signer to the logfile (in all sections where it makes sense):
  • for all Microsoft files the mark will look like this: (Sign: 'Microsoft')
  • unsigned files: (no sign)
  • files with signature verification error: (invalid sign)
  • files with a successfully verified signature, however without trust of the root certificate: (sign: '', but untrusted root: '' with fingerprint: )
  • the signature is specified for the main file, not the argument. The exceptions are: O22 (based on Rundll32 and CLSID) and O23 host services, which displays the name of the dll signer.
  • other details can be found in additional help (RU only): https://www.safezone.cc/threads/dopolnenie-v-rukovodstvo-po-hijackthis.27470/post-333487
• EDS verification tool:
  • added field "Root Issuer" - name of the issuer of the root certificate.
  • added field "API error code" - GetLastError verification functions. Do not rely on this code as a validation result.
  • added field "Signer name (friendly)" - name of the signer, as it appears in the explorer properties window.
  • fixed lot of bugs.
• Optimization of the file existence check code.
• Support for Ctrl + A to select all text in input fields.
• Fixed: Data corruption while copying/pasting text into input fields with a different keyboard layout.
• Fixed: in O23 - Drivers some paths were specified with wrong redirector.
• Fixed: missing -32 prefixes for some sections.
• For O10 LSP Fix under Windows 8+ it is recommended to use Uncle Carey's NetFix utility.
• Updated the list of well-known DNS address substitutions for O17.
• Blocked possible closing of the window by the user in case of lag (thanks to The Trick).
• Installer: Added shortcut "Registry Key Type Analyzer".
• Auto-update: Improved installation of HiJackThis when it is shipped with multiple files.
• Auto-update: Fixed several bugs when HJT is installed to another folder via /instDir key (thanks to de-served).

[dragokas]

[3.1.0.2 Alpha] - June 19, 2023

• EDS verification tool:
  • added expert options
  • added PE EXE filter (search for all files corresponding to the Portable Executable format)
  • O23 - Driver: Fixed skipping 3rd party drivers signed with single signature (by Microsoft).
  • O23 - Driver: If the third party driver is only signed by Microsoft, the "CompanyName" field from the file properties will be added to the mark.
  • Forced launch in "Additional Scan" mode if HJT v3.1.0.1 or lower was in use before.

[dragokas]

[3.2.0.1 Alpha] - Sep 17, 2023

• [new] Added detection of O7 - Policy: Bitcoin wallet address hijacker is present (no fix).
• [new] Added section O27 - Account & Remote desktop protocol. Description can be found in menu Help - About - Sections.
• O7 - Autologon is moved in O27.
• Added mark "(no fix)" - which means the fix is not provided.
• Registry Key Analyzer: added option "Create key if not exists" (it should create key and instantly remove after checking if it didn't exist).
• [clean] Pending delete file operations items are moved to whitelist (known as PendingFileRenameOperations -> DELETE).
• Autobackup registry (ABR) is updated to v1.10.
• Removed suggestion to use Uncle Carey's Windows 10 NetFix to fix O10 - LSP, because this utility became payed. For Windows 8.1 use other tools, like: https://support.kaspersky.ru/common/windows/12378
• Fixed compatibility with Windows XP.
• Windows 2000 is no longer supported.

[dragokas]

[3.2.0.2 Alpha] - Oct 09, 2023

• Fixed a bug with displaying the user group name.
• Fixed code looping on some interceptions.
• The "Hosts file manager" module has been rewritten with more reliable code; added "Reset" and "Update" buttons; The "Open" button now launches the default editor.
• The style of the main menu buttons has been replaced and unified to be identical in all OS versions. The buttons support themes, however so far only one theme has been drawn (dark).
• Removed the "Misc Tools" button.
• The "Online Guide" button has been renamed to "Tutorial & Support", and now opens a submenu with access to a choice of online/offline help and treatment forums.
• Renamed the "List of Backup" button to "Backups".
• Renamed the menu button "Help" - "Support" to "Report a bug".
• The "Do a system scan..." buttons are no longer disabled when scanning; pressing again will switch you to the results window.
• Fixed quality/cropped logo at DPI >= 150 (thanks to Eduardo and VanGoghGaming for help).
• References to Dr.Web were deleted because the company no longer uses HiJackThis for the treatment on forum.
• Minor corrections to the translation and the main project page.
• Improved debugging mode.

[dragokas]

[3.3.0.5 Alpha] - Nov 02, 2023

• All UI elements have been replaced with Unicode counterparts (thanks to Krool and VanGoghGaming).
• Fixed out-of-buffer writing in rare cases with incorrect registry keys.
• Fixed insufficient control with an attempt to check the digital signature of a folder, which could lead to a crash due to the redirector being disabled (thanks to Sandor for the support).
• Fixed Kaspersky false positive on the fix behavior. To prevent this from happening, unpack all utility files from the archive (thanks to akok for the notification).
• Comprehensive cleaning and code "obfuscation" from primitive checks of antiviruses and sandboxes to prevent their suspicions (thanks to akok for the help).
• Refactoring of the program initialization stage.
• Loading of the main menu has been accelerated.
• Hosts Manager: reset is standardized to the default hashes of the vanilla OS hosts file; fixed "Open in editor" button.
• List of OS editions has been updated.
• Improved compatibility with Windows XP and Vista.
• Changed the settings storage key. The previous settings will be moved automatically.
• Unnecessary databases are removed.
• Dead links are removed.
• Dependency on Microsoft MSCOMCTL32 is removed.
• Temporary: dependency on the apps\VBCCR17.OCX component

[dragokas]

[3.3.0.6 Alpha] - Nov 02, 2023

• Deleting the log before starting the scan
• Corrected program version

[dragokas]

[3.3.0.7 Alpha] - Nov 09, 2023

• Fixed broken checkboxes of lists after the latest update.

[dragokas]

[3.3.0.8 Alpha] - Nov 27, 2023

• Added escaping of line breaks and non-printable characters. Format: \x1F, where 1F is the ASCII code of the character in Hex.
• Added remembering of the last opened folder in various tools.
• Fixed file modification time during assembly.
• Added build date to the log header.
• Workaround for problems in Windows that prevent HijackThis from running.

[dragokas]

[3.3.0.9 Alpha] - Dec 15, 2023

• Added detection of autorun Null-values.
• Added the database of LolBin files with updates from lolbas-project.github.io service (thanks to @oddvarmoe, @bohops, @xenosCR, @ConsciousHacker, @liamsomerville, @Wietze, @_josehelps)
• HijackThis fix is protected against accidental deletion of LolBin files that didn't pass digital signature verification for some reason.
• Escaping http => hxxp.
• Additional information is displayed for unsigned files: company from the file properties and SHA1 hash.
• The way of obtaining paths to processes has been changed - it doesn't require opening the process (thanks to @fafalone).
• O7 - TroubleShooting: improved checking of %Temp% system profiles.
• Auto-removal of DACL locks of HJT settings keys.
• More reliable handling the clipboard (thanks to @wqweto).
• MS certificates list has been updated (thanks to Sandor).
• Whitelists have been updated.
• Other fixes.

[dragokas]

[3.3.0.10 Alpha] - Dec 18, 2023

• Unlocked the ability to remove services with Microsoft-signed executable.
• Added company and SHA1 hash output for files with damaged digital signature, marked as "(invalid sign)".
• The allowed file size for hash verification has been increased to 300 MiB. If the check exceeds or fails, this will be indicated in the log.
• Improved digital signature verification: for Win 8+, the secondary signature (of the manufacturer) is displayed, if the primary signature by Microsoft.
• Bugs of the previous build have been fixed.

[dragokas]

[3.3.0.11 Beta] - Dec 21, 2023

• O7 - KnownFolder: added checking for physically missing folders.
• Fixed HijackThis installation error.
• The Hosts File Manager tool is presented as a separate window.
• Added Anti-BSOD when deleting services.
• Fixed a bug where the standard font wasn't applied by some forms.
• Added the ability to change the standard UI font separately from the list font.
• Fixed errors in compatibility with XP/Vista, checking minimal processes on Win 8+.

[dragokas]

[3.4.0.1 Alpha] - Jan 28, 2024

• Fixed a vulnerability in the buffer overflow of the scan results list.
• Fixed a critical error in the HiJackThis backup restoration function:
  • It is not recommended to use the "Restore" button for backups in versions 3.3.0.5 - 3.3.0.11 without updating to this version, as it may destroy all other backups;
  • However, it is safe to revert to backups created by previous versions of HiJackThis.
• Compatibility improvements and BCD fix when using registry restoration through Autobackup Registry:
  • ABR updated to v1.12 (thanks to D.Kuznetsov).
• Fixed a crash on right-click on certain items in scan results (thanks to de-served for reporting).
• O7 - KnownFolder: (folder missing) false triggering on legal redirection fixed. The redirection fix now also includes creating folder structure (thanks to de-served).
• UI behavior fixes for Ctrl + F.
• Fixed regression: item not being marked on double-click.
• Added escaping www. => vvv.
• Improved program update procedure for certificate errors (thanks to regist).
• O22, O23 whitelists have been updated.
• MS certificates have been updated (thanks to Sandor).