Skip to content
Switch branches/tags


Failed to load latest commit information.
Latest commit message
Commit time
Feb 11, 2021
Jul 23, 2021
Oct 20, 2018
Dec 3, 2017
Feb 1, 2021

HiJackThis Fork v3

Hi, I am Stanislav Polshyn - a lawyer, security observer and malware researcher from Ukraine (Chernobyl, Klitschko, Na'Vi).

I am happy to present a continuation of Trend Micro HiJackThis development, once a well-known tool.

At the moment, it is a step-by-step 100% rewritten source code of the original engine, created in my free time as a hobby for more than 4 years.


HiJackThis Fork is a free utility for Microsoft Windows that scans your computer for settings changed by adware, spyware, malware and other unwanted programs.

HiJackThis Fork primarily detects hijacking methods rather than comparing items against a pre-built database. This allows it to detect new or previously unknown malware - but it also makes no distinction between safe and unsafe items. Users are expected to research all scanned items, and only remove items from their PC when absolutely appropriate.

Therefore, FALSE POSITIVES ARE LIKELY. If you are ever unsure, you should consult with a knowledgeable expert BEFORE deleting anything.


Pre-built binary (release version) for Windows

Nightly build (private test version) for Windows


  • Lists non-default settings in the registry, hard drive and memory related to autostart
  • Generates organized, easily readable reports
  • Does not use a database of specific malware, adware, etc
  • Detects potential methods used by hijackers
  • Can be configured to automatically scan at system boot up


  • Short logs
  • Fast scans
  • No need to manually create fixing scripts
  • No need for Internet access or recurring database updates
  • Already familiar to many people
  • Portable

New in version 3

  • Detects several new hijacking methods
  • Fully supports new Windows versions
  • New and updated supplementary tools
  • Improved interface, security and backups

HiJackThis also comes with several useful tools for manually removing malware from a computer:

  • StartupList 2 (*new*)
  • Process Manager
  • Uninstall manager
  • Hosts file manager
  • Alternative Data Spy
  • Delete file / service staff
  • Digital Signature Checker (*new*)
  • Registry key unlocker (*new*)
  • Check Browsers' LNK & ClearLNK (as downloadable components) (*new*)

Log analysis

IMPORTANT: HiJackThis Fork does not make value-based calls on what is considered good or bad. You must exercise caution when using this tool. Avoid making changes to your computer settings without thoroughly studying the consequences of each change.

If you are not already an expert, we recommend submitting your case to an online help forum. Here are some suggestions:

Note: currently, only Russian-speaking anti-malware supporting team (e.g., VIRUSNET association) can provide direct analysis of HiJackThis logs in our github 'Issues' section. Please feel free to ask help there (English only).

Technical support

System Requirements

Operating System

  • Microsoft™ Windows™ 10 / 8.1 / 8 / 7 / Vista / XP / 2000 (32/64-bit desktop and server)


Thanks to:

  • regist (VIRUSNET) { @regist } - for the valuable tips and ideas, user's manual, database updates, closed and beta-testing
  • Sandor (VIRUSNET) { @Sandor-Helper } - for the beta-testing, lot of reports, PC treatment on GitHub and forums of association
  • akok (VIRUSNET) { @akokSZ } - for product promotion, providing a platform for tests and discussion, help with resolving conflicts with antiviruses
  • team (general VIRUSNET community) - for promotion and support, feedback and bug reports, PC treatment on forums of association
  • Fernando Mercês { @merces } (Trend Micro) - coordinator of original HJT, for the tips, suggestions and promotion
  • Loucif Kharouni { @loucifkharouni } (Trend Micro) - coordinator of original HJT, for the tips & suggestions

HiJackThis Fork by Alex Dragokas (my pseudonym) is a continuation of Trend Micro HiJackThis development, based on v.2.0.6 and 100% rewritten at the moment. It was initially supported by Trend Micro, but they have since refused support and closed the GitHub repository. HiJackThis Fork is distributed under the GPLv2 license. It also includes several tools and plugins available as freeware.

Reviews & Mirrors


Note: These mirrors belong to other companies. They are non-official.


For more than four years, I have maintained this project in my free time. If you find it useful, you can support me for further inspiration by donating any amount to:

Other projects

You may also find my other programs useful: