[TUTORIAL] HijackThis

Post by **sniper3d** » Tue 17 Jan 2012 17:29

In this tuto we're going to try to help you understand what this great software brings.

This content is for members only. Log in or register for free to see it.

After downloading and installing, we're going to rename HijackThis

Why rename Hijackthis?

Nowadays, computer pirates and hackers have adapted to our PC disinfection techniques. So they've found new ways to stop us from detecting and eradicating their malware.

Pirates are clever little guys who know Hijackthis just as well as we do!

This program is safer to use in safe mode, but by renaming it you can use it in normal mode, because a pirate has a one in a million chance of finding your own location.

Also renaming Hijackthis in some cases lets you catch an infection that was carefully hidden from the scan (example: some "Vundos" infections hide when hijackthis.exe is launched but not another .exe). So we'll name it jackthis.exe

For more security, choose the location yourself, my renaming is just an example

When installing the program, by default it's located in

C:\Program Files

We're going to rename it like this C:\Program Files\jackthis
Image unavailable (removed by its host) To avoid any mistake with extensions we're going to show them (be careful now when renaming your files not to rename the extension):

Start --> My Documents --> Tools then Folder Options
Go to the View tab and check if the following line is unchecked:
Image unavailable (removed by its host) If that's not the case, uncheck it and click apply.

Now go to C:\Program Files\jackthis\Trend Micro\HiJackThis
Image unavailable (removed by its host) Rename like this: jackthis.exe

Here's the result Image unavailable (removed by its host)
Last thing to do, delete the shortcut on the desktop and create a new one with the new name

Hijackthis analysis and understanding the report

A HijackThis report is divided into several distinct parts. Here are the main parts you can find in a report:

R0, R1, R2, R3 - Internet Explorer Startup/Search pages URLs
F0, F1 - Programs that start automatically at startup
N1, N2, N3, N4 - Netscape/Mozilla Start/Search pages URLs
O1 - Hosts file redirection
O2 - Browser Helper Objects
O3 - Internet Explorer toolbars
O4 - Automatic program startup from the registry or the Startup List.
O5 - Internet options not visible in the control panel
O6 - Access to Internet options denied
O7 - Access to the registry editor denied
O8 - IE context menu (right-click) modified
O9 - Extra button in the IE taskbar, or extra item in the "Tools" menu
O10 - Winsock hijacker
O11 - Extra group in IE's "advanced options"
O12 - IE plugins
O13 - IE DefaultPrefix hijack
O14 - "Reset Web Settings" hijack
O15 - Unwanted sites in the trusted zone
O16 - ActiveX Objects (aka Downloaded Program Files)
O17 - Lop.com domain hijackers
O18 - Extra protocols and protocol hijackers
O19 - User style sheet hijack

R0, R1, R2, R3 - Internet Explorer Startup/Search pages URLs

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.thestartpage.info/search/?&q={searchTerms}
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

What to do?
If you don't recognize the object's name, or the URL, or where it was downloaded from, FIX Checked!!!
If the URL contains words like "dialer", "casino", "free_plugin", etc... FIX Checked right away!!!

O17 - Lop.com domain hijacks

O17 - HKLM\System\CCS\Services\Tcpip\..\{D9871CB6-3F02-430F-8FCB-5A4368C5C057}: NameServer = 192.xxx.xxx.xxx

What to do?
If the domain is not that of your ISP or your company's network, FIX Checked!!!
Same for "SearchList" type entries.
For "NameServer" type entries (DNS servers), search for the IPs on GOOGLE and you'll be sorted out right away!

O18 - Extra protocols and protocol hijackers

O18 - Protocol: relatedlinks - {5AB65DD4-01FB-44D5-9537-3767AB80F790} - C:\PROGRA~1\COMMON~1\MSIETS\msielink.dll
O18 - Protocol: mctp - {d7b95390-b1c5-11d0-b111-0080c712fe82}
O18 - Protocol hijack: http - {66993893-61B8-47DC-B10D-21E0C86DD9C8}

What to do?
A small number of hijackers are capable of this. The best known are "cn" (CommonName), "ayb" (Lop.com) and "relatedlinks" (Huntbar), FIX Checked!!!
Anything that shows up and isn't sure to be clean, FIX Checked!!!

O19 - User style sheet hijack

O19 - User style sheet: c:\WINDOWS\Java\my.css

What to do?
If your browser is heavily slowed down or overrun by popups, FIX Checked.
However, since Coolwebsearch is the only one doing this type of hijack, it's better to fix this problem with CWShredder.

Hoping this helped a bit, think of the forum and a little thank you costs nothing

Post by **sniper3d** » Tue 17 Jan 2012 18:45

If you don't rename the .exe, it's true you have to do it in safe mode, that's better

On the other hand if you name it whatever you like, a hacker has a one in a million chance of finding the location where you installed it

As for the log, it's true you can post it on the site, but to get started and with a bit of savvy, by following the tuto, 3/4 of them you can delete yourself. Now I can add the log link

Thanks for the 224 mistakes

Post by **Oops** » Tue 17 Jan 2012 19:48

a pretty handy tool but not easy to decipher when you're not familiar with it. Thanks for these clarifications

Post by **sniper3d** » Sun 29 Jan 2012 13:38

mamule

[TUTORIAL] HijackThis