<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>gHacks technology news &#187; hijackreader</title>
	<atom:link href="http://www.ghacks.net/tag/hijackreader/feed/" rel="self" type="application/rss+xml" />
	<link>http://www.ghacks.net</link>
	<description>A technology blog covering software, mobile phones, gadgets, security, the Internet and other relevant areas.</description>
	<lastBuildDate>Tue, 24 Nov 2009 23:31:44 +0000</lastBuildDate>
	<generator>http://wordpress.org/?v=2.8.6</generator>
	<language>en</language>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
			<item>
		<title>HijackReader analyse HijackThis results</title>
		<link>http://www.ghacks.net/2008/02/08/hijackreader-analyse-hijackthis-results/</link>
		<comments>http://www.ghacks.net/2008/02/08/hijackreader-analyse-hijackthis-results/#comments</comments>
		<pubDate>Fri, 08 Feb 2008 10:42:01 +0000</pubDate>
		<dc:creator>Martin</dc:creator>
				<category><![CDATA[Security]]></category>
		<category><![CDATA[Tools]]></category>
		<category><![CDATA[software]]></category>
		<category><![CDATA[hijackreader]]></category>
		<category><![CDATA[hijackthis]]></category>
		<category><![CDATA[Windows]]></category>

		<guid isPermaLink="false">http://www.ghacks.net/2008/02/08/hijackreader-analyse-hijackthis-results/</guid>
		<description><![CDATA[HiJackThis</a> is a sophisticated security tool that checks a computer running Windows 2000 or higher for possible signs of hijacked applications. It does check lots of different elements like startup items, Browser Helper Objects, running processes and the like and presents a log of the results at the end. This log is hard to read for beginners because it contains "good" and possible "bad" elements in it and it requires knowledge of those elements to make a distinction between elements that you have to keep and those that are indeed malicious in nature.]]></description>
			<content:encoded><![CDATA[<p><a href="http://www.spywareinfo.com/~merijn/programs.php#hijackthis">HiJackThis</a> is a sophisticated security tool that checks a computer running Windows 2000 or higher for possible signs of hijacked applications. It does check lots of different elements like startup items, Browser Helper Objects, running processes and the like and presents a log of the results at the end. This log is hard to read for beginners because it contains &#8220;good&#8221; and possible &#8220;bad&#8221; elements in it and it requires knowledge of those elements to make a distinction between elements that you have to keep and those that are indeed malicious in nature.</p>
<p>Most users tend to post their logs in forums so that experienced users can take a look at them and recommend actions. There are actually several forums that can be used. </p>
<p>If you would like fast results you could also use the software <a href="http://www.hollmen.dk/content/view/69/31">HijackReader</a> which analyzes an HijackThis logfile and tries to make the distinction between good and bad results automatically. The HijackReader uses mainly two lists to analyze the logfile. </p>
<p><span id="more-3164"></span><img src='http://www.ghacks.net/wp-content/uploads/2008/02/hijackreader.jpg' alt='hijackreader' /></p>
<p><a href="http://www.sysinfo.org/">Those</a> two lists are the CLSID list by Tony Klein and the Startup info list by Paul Collins. A single html file is created after the analysis has finished displaying information and recommendations about the found elements. Attributes can either be OK (no fix needed), FIX IF UNKNOWN (check for more information if you do not know the element), FIX (CHECK NOTES!) (read the description and fix the issue because it is indeed malicious) and UNDETERMINED (find out for yourself).</p>
<p>The HijackReader application can be of help especially if items are found that are marked as Fix (Check Notes). The user can fix those without having to wait for someone else to analyze his logfile and tell him the exact same thing. It does not help that much for elements that are undetermined or marked as fix if unknown and users will still have to get professional help or do extensive research before they can be sure if the item is malicious or not.</p>

	Tags: <a href="http://www.ghacks.net/tag/hijackreader/" title="hijackreader" rel="tag">hijackreader</a>, <a href="http://www.ghacks.net/tag/hijackthis/" title="hijackthis" rel="tag">hijackthis</a>, <a href="http://www.ghacks.net/tag/security/" title="Security" rel="tag">Security</a>, <a href="http://www.ghacks.net/tag/software/" title="software" rel="tag">software</a>, <a href="http://www.ghacks.net/tag/windows/" title="Windows" rel="tag">Windows</a><br />

	<h4>Related posts</h4>
	<ul class="st-related-posts">
	<li><a href="http://www.ghacks.net/2009/04/27/unknown-file-in-winsock-lsp-nwprovaudll/" title="Unknown File in Winsock LSP NWPROVAU.DLL (April 27, 2009)">Unknown File in Winsock LSP NWPROVAU.DLL</a> (3)</li>
	<li><a href="http://www.ghacks.net/2008/07/07/true-crypt-6-released/" title="True Crypt 6 released (July 7, 2008)">True Crypt 6 released</a> (3)</li>
	<li><a href="http://www.ghacks.net/2008/03/21/protect-files-in-windows-by-locking-them/" title="Protect Files in Windows by locking them (March 21, 2008)">Protect Files in Windows by locking them</a> (6)</li>
	<li><a href="http://www.ghacks.net/2006/05/08/open-ports-10/" title="Open Ports 1.0 (May 8, 2006)">Open Ports 1.0</a> (2)</li>
	<li><a href="http://www.ghacks.net/2008/03/06/norton-antibot-free-1-year-license/" title="Norton Antibot Free 1 Year License (March 6, 2008)">Norton Antibot Free 1 Year License</a> (15)</li>
</ul>

]]></content:encoded>
			<wfw:commentRss>http://www.ghacks.net/2008/02/08/hijackreader-analyse-hijackthis-results/feed/</wfw:commentRss>
		<slash:comments>6</slash:comments>
		</item>
	</channel>
</rss>
