You can download HijackThis here: HijackThis.exe
Make a separate folder to save the file in, since the backups the program makes will end up in the folder where hijackthis.exe is.
After clicking the link above, choose Save in this screen.
Rightclick in an empty part of the explorer windows(II), choose New (III) and folder (IV).
Name the folder, f.e. Hijackthis, open that folder and click on Save (V)
When you start HijackThis by doubleclicking HijackThis.exe, you will see this screen. Click "Scan".
Afetr doing so the entries will show up in your screen. Click "Save Log".
Preferably save the log as a .txt file. See screenshot.
In the textfile that opens by itself, click "Edit"(1) > "Select all"(2) Then rightclick the selected (blue in the example) part(3) and choose "Copy"(4).
What you copied can now be pasted on the forum.
With a little luck you will receive an answer that names a few entries that should be fixed.
Put a checkmark in front of those entries and click "Fix checked".
Make sure and close as many windows as possible before you use "Fix checked". Especially if IE windows are open some fixes will have no effect otherwise.
To the main page
Back to where you came from
In some cases the person helping you will ask for a StartUpList.
To make one follow these instructions: In the main screen of HijackThis click "Config" > "Misc Tools"
Then you will see the screen below. The helper should normally have told you which (if any) boxes to check under the "Generate Startuplist log" button.
Put a checkmark in those and click "Generate StartupList log".
This will immediately result in a .txt file, so no hassle necessary to save it as such.
Very rarely someone might also ask you to calculate the MD5 values.
This works like this.
In the main screen of HijackThis click "Config" > "Misc Tools"
Then click "Back" and only then click "Scan"
When prompted (as shown below) whether you want to skip a certain file click Yes, unless you know that file was of interest for this Scan.
The rest works the same again as explained in the first part.
At other times the helper will ask you to post a both.log
To do so browse to the HijackThis folder
It should look like this
Doubleclick ht.bat and wait until you see the resulting both.log at the foreground.
In that text file click "Edit" > "Select all"
Then rightclick the selected (highlighted) and choose "Copy".
On the forum you can rightclick in the Reply field and choose "Paste"
This section has a few subsections
A standalone version of this utility is available as "Itty Bitty Process Manager" The advantage over Windows built-in TaskManager is that it shows the full path to the running file.
That makes it easier to find malware using Windows filenames.
Putting a checkmark in the "Show DLLs" box enables you to look at the dll's loaded by the selected process.
Gives you the option to delete lines from the hosts file.
When run on a system with no hosts file it gives you the option to create a default hosts files that looks like this:
If you click this button, an explorer window will open to enable you to select a file.
The selected file will be deleted on reboot so you can delete files that are currently in use.
The warnings are there for a reason. Be carefull using this option.
A standalone version of this utility is available as ADS Spy. Ads Spy is a tool used to list, view or delete Alternate Data Streams (ADS) on Windows 2000/XP with NTFS file systems.
For use on a forum use the settings displayed below and post the content of the log mad by using the "save Log..." button.
