HiJackThis+: scanning Windows for the methods hijackers use
A free utility that finds malware, adware and other security threats
At a glance
- What is it?
- HiJackThis+ is a free Windows scanner that lists the autostart entries, registry changes and files left behind by adware and malware, and it works by recognising hijacking methods rather than comparing against malware signatures. That design finds unknown threats and produces no safety verdict of its own, so the log is meant to be read by a person who knows what they are looking at.
- Who is it for?
- Adopt HiJackThis+ if you are cleaning up a machine that has been carrying unwanted software, or if you support other people doing that work and want a fast, offline log of what changed. Do not adopt it as a security control in its own right, since it is a passive scanner with no real-time protection and no safe or unsafe judgement, and do not run it on a machine whose changes you cannot reverse.
- Can I use it commercially?
- Yes, with conditions. GPL-2.0 is a copyleft licence: if you distribute software that includes it, you must release that software's source code under the same licence. Running it internally without distributing it does not trigger that obligation.
- Is it still maintained?
- Yes. The repository last received commits 113 days ago.
- What is it written in?
- Mainly Visual Basic 6.0, according to GitHub's language statistics.
Answers come from the project's GitHub data, last synced on October 22, 2026, and from our analysis. They are not legal advice.
Editorial analysis
What the scanner actually looks at
HiJackThis+ is a free utility for Microsoft Windows that scans a computer for settings changed by adware, spyware, malware and other unwanted programs. The README compares it to Sysinternals Autoruns, which is the clearest description of its scope: it enumerates the places a program registers itself to run automatically.
The feature list is specific about the surfaces. It lists non-default settings in the registry, on the hard drive and in memory that are related to autostart. It generates organised, easily readable reports, it does not use a database of specific malware or adware, and it can be configured to scan automatically at system boot.
The project is a fork and continuation of the original Trend Micro HiJackThis by Merijn Bellekom, previously known as HiJackThis Fork v3. According to the README, the engine is a step-by-step 100% rewritten source code of the original, aimed at full compatibility with recent Windows releases while keeping scans fast and the logfile short. It is written primarily in Visual Basic 6.0 and is maintained by Alex Dragokas, who describes himself as a lawyer, security observer and malware researcher.
The audience splits in two. One group is a user who suspects their machine is carrying unwanted software and wants to see what changed. The other is the expert community that reads those logs, and the project goes out of its way to support the second group with documentation, tutorials and a place to submit logs for analysis.
Detecting methods instead of matching signatures
This is the design decision that makes the tool different, and it is worth understanding before using it.
The difference from a classical antivirus, in the README's own framing, is the ability to function without constant database updates. HiJackThis+ primarily detects hijacking methods rather than comparing items against a pre-built database of signatures. The consequence runs both ways. It can detect new or previously unknown malware, because it looks for the shape of a hijack rather than for the bytes of a known sample. And it also makes no distinction between safe and unsafe items, because the judgement of what is dangerous was never part of what it computes.
The README states the consequence in capitals: false positives are likely, and if you are ever unsure you should consult a knowledgeable expert before deleting anything. It repeats the point in the log analysis section, saying the tool does not make value-based calls on what is considered good or bad, and warning against changing settings without thoroughly studying the consequences of each change.
That is a coherent position rather than a caveat bolted on. A tool that lists what a machine does at startup is useful to someone who knows what each entry means, and unhelpful to someone who does not. The README is direct about the audience for that reason: if you are not already an expert, the recommendation is to submit your case to a help forum rather than to act on the log alone.
Setting up a boot-time scan with an ignore list
The README describes a specific way to use the scanner as a boot-up automatic scanner, and it is the most useful routine in the documentation for a machine that is already clean.
You start by running the scanning with the Do a system scan only option, so the tool records the current state without opening any of the repair or removal interfaces. You then add all items in the ignore-list, which is the step that makes the later automated runs useful: the baseline is what you decide is normal for this machine, and everything else becomes a change worth looking at.
With the baseline set, you enable the boot-up scan through the menu path File, Settings, Add HiJackThis to startup. On the next login, HiJackThis silently scans the operating system and displays the interface only if new records in your system were found. On an unchanged machine you see nothing at all, and on a changed one you see the new entries and nothing about the ones you already accepted.
That design is why the ignore-list step comes first and why it is not optional in practice. Without a baseline, every entry in the log is new on every run, and the signal that makes the tool useful disappears into noise. The project also notes that the tool is portable, which matters for this workflow because the executable can live on a removable drive and the ignore-list travels with it.
The modules bundled alongside the scanner
HiJackThis+ ships with a set of auxiliary tools aimed at specific analysis and removal tasks, and the README lists them by name.
StartupList 2 enumerates startup entries, Process Manager works with running processes, and the Uninstall Manager handles installed programs. The Hosts File Manager covers the hosts file, which is a common hijacking target for redirecting traffic. Alternative Data Spy looks at alternate data streams, the streams that hide data inside a file on NTFS volumes. The Services Removing Tool deals with services, and the Batch Digital Signature Checker verifies digital signatures across many files at once.
Five of them are marked as new: StartupList 2, the Batch Digital Signature Checker, the Registry Key Type Analyzer, the Registry Key Unlocker and the Files DACL Unlocker. The last two are about permissions rather than detection, unlocking a registry key or a file's discretionary access control list so that a scanner can read or change something that was deliberately protected. The browser shortcut checker and its companion, ClearLNK, are described as downloadable components rather than part of the main executable, and they address the trick where a shortcut points somewhere other than the program it appears to launch.
Taken together, the modules cover the three things unwanted software touches: what runs, where the system has been redirected, and what is hidden.
Supported Windows versions and the places it does not run
The compatibility statement is explicit. The tool supports Microsoft Windows 11, 10, 8.1, 8, 7, Vista and XP, in both 32-bit and 64-bit flavours, and on both desktop and server editions. Windows Recovery Environment and LiveCD are not supported.
That exclusion is worth pausing on, because the boot-time scanning workflow described above pushes towards the recovery environment. A machine that will not boot into Windows is exactly the case where you would want the scanner, and the tool does not run there. Anyone building a cleanup workflow around it needs another path for the unbootable case.
The implementation language also tells you something about the audience. Visual Basic 6.0 is a language with a long history and a large body of practical Windows development knowledge behind it, and its use here is consistent with a tool aimed at people who read logs and act on them rather than with a library embedded in a security product.
For anyone starting out, the project points to a list of tutorials in its wiki, plus a short user manual in English and a complete user manual in Russian on an external site.
Where HiJackThis+ is the wrong tool
The README says it directly: HiJackThis+ is not a replacement for a classical antivirus, and it does not provide real-time protection because it is a passive scanner only. The recommended posture is to consider it an addition. If your requirement is protection against malware rather than an inventory of what a machine was made to do, this tool does not meet it, and no configuration of it will.
The second limitation is the false positive rate, and it interacts with the tool's interface. Because the report makes no value judgement, a user who acts on entries without understanding them can disable something that matters, and the README warns specifically against that. The boot-time workflow reduces the volume of what a user sees, but it does not make the remaining entries safe to remove automatically.
The third limitation is the analysis model itself. Detecting methods means listing places where something registers itself to run. Malware that never touches those surfaces, and software whose behaviour is entirely legitimate by the standards of the method list, are outside what the tool reports. Autoruns, the tool the README compares it to, has the same shape, which is why the README's framing is the right mental model: this is an inventory tool that produces a diff against a baseline you approve.
For people who are not experts, the honest alternative is a consumer antivirus product with real-time protection and its own reputation system, which trades the raw truth of the log for a verdict. The trade is the point of the two designs.
Distribution, maintenance and licence
Distribution is unusual for a project of this age, and worth knowing before you look for a download. The README links a latest build from the author's own site as a test archive, marked as a beta version with major changes in progress, and separately a stable build that is labelled v2 and explicitly noted as outdated and no longer updated. There are no GitHub releases carrying binaries; the single release tag in the repository is v3 from 2021-10-19.
The source repository is correspondingly small in scope: a src directory, the README, a contribution guide and a licence file. The default branch is devel, and the last push was on 2026-07-02. The repository is not archived, but the gap between the 2021 tag and the recent commits is long, which is the pattern of a mature tool that is maintained rather than actively extended.
The licence is GPL-2.0, with a LICENSE.md at the root, and the copyright section credits Alex Dragokas for the fork, its refactoring, additions and tool integration, and Merijn Bellekom for the original HiJackThis. That means the fork's source is available and its terms carry the copyleft obligations of the GPL, though the prebuilt binaries are what most people download.
One last practical point from the log analysis section: the README says that currently only the VIRUSNET association can provide direct analysis of HiJackThis+ logs, through the issues section of the project's GitHub repository, in English or Russian.
Editorial conclusion
Adopt HiJackThis+ if you are cleaning up a machine that has been carrying unwanted software, or if you support other people doing that work and want a fast, offline log of what changed. Do not adopt it as a security control in its own right, since it is a passive scanner with no real-time protection and no safe or unsafe judgement, and do not run it on a machine whose changes you cannot reverse. Verify first that your Windows version is on the supported list and that you are not in a WinRE or LiveCD environment, that you have read the log rather than the report's alarm, and that you have a restore point or a backup before acting on any entry it shows.
Frequently asked questions
Does HiJackThis+ replace an antivirus program?
No. The README says it is a passive scanner with no real-time protection and should be considered an addition to a classical antivirus, since it lists what a machine was configured to do rather than blocking threats.
How do I make HiJackThis+ scan automatically at boot?
Run a system scan only, add every expected item to the ignore-list, then use File, Settings, Add HiJackThis to startup. On the next login it scans silently and shows the interface only when new records are found.
Does HiJackThis+ need internet access or malware signature updates?
No. It detects hijacking methods instead of comparing items against a database of signatures, which is why it needs no recurring database updates and can spot previously unknown malware, but also why it makes no distinction between safe and unsafe items and false positives are likely.
Which Windows versions does HiJackThis+ support?
Windows 11, 10, 8.1, 8, 7, Vista and XP, in 32-bit and 64-bit desktop and server editions. WinRE and LiveCD environments are explicitly not supported.
Who can analyse a HiJackThis+ log for me?
The README says that currently only the VIRUSNET association can provide direct analysis of HiJackThis+ logs, through the issues section of the project's GitHub repository, in English or Russian.
Official sources
Add this badge to your README
If you maintain this project, the badge below links readers to this analysis and shows its maintenance status from the daily GitHub snapshot. Paste the markdown into your README; add ?metric=license or ?metric=stars to the image URL for a different field.
[](https://hysenlabs.com/projects/dragokas-hijackthis)Was this useful?