HijackThis

» see merijn.org as it lived, on the wayback machine

~ the obit ~

Almost every security tool of that era was built to tell you what it thought. HijackThis was built to refuse. It walked the registry keys and startup paths that a hijacker had no choice but to touch, wrote what it found into a text box, and left it there. Apart from a very short whitelist it made no distinction between the driver your laptop needed to boot and the thing that had replaced your homepage. That refusal was the design, not a gap in it, because the author had worked out that any list of known-bad entries would be out of date by the weekend.

Merijn Bellekom was a student at Utrecht, a chemistry graduate who was then reading information science, and he wrote it around 2002 while he was also writing CWShredder for one specific family of browser hijackers. Both tools got big enough that maintaining them stopped fitting around a degree. CWShredder went to InterMute on 19 October 2004 and HijackThis went to Trend Micro in March 2007. Trend Micro published the source under the GPL on SourceForge on 16 February 2012. It shipped version 2.0.5 on 18 May 2013 and never shipped another.

This one crossed the border without needing anything done to it. A HijackThis log is registry paths and file paths, which are the same strings on a Windows install in Ankara as on one in Ohio, so the output was already in the only language it needed. Turkish forums ran the identical ritual under Turkish thread titles: somebody posts the wall of text, somebody who has read a few hundred of these replies with two or three line numbers to tick. The tool was never localized and never needed to be. What did not travel was the second half of the product, because a log with nobody to read it is just a list.

~ the rap sheet ~

~ the log ~

The output was prefixed rather than explained. R1 lines were the browser's search and start pages and O4 lines were the things that ran when Windows came up, with a couple of dozen more classes underneath those. Nothing in the file said which entries were safe. The program would back up whatever it removed, on the reasonable assumption that people were going to tick the wrong boxes.

This produced a small industry of log readers. Sites like hijackthis.de would parse a pasted log and score each line against what other people had submitted, and the people who actually did this work by hand disliked those parsers intensely, on the grounds that a machine confidently marking an unknown entry as harmless is worse than no answer. It is a strange thing for software to depend on: the program's accuracy was fixed in 2002 and the useful part kept improving, because the useful part was a group of volunteers getting more practice.

~ i give up, alex ~

The archive's oldest capture of merijn.org, from 24 January 2004, opens with a warning that the page you are reading may be unreachable, because one variant of the CoolWebSearch trojan blocked the domain outright. There is a raw IP address underneath as a way in. Malware that edits your hosts file so you cannot reach the site hosting its cure is a level of attention most authors never got.

The same page carries the note underneath: a new variant was killing CWShredder and HijackThis along with the other cleanup tools people ran, and Bellekom wrote "On a less positive note, I give up. Alex, you win this one." He kept releasing for another three years after writing that. The sentence is still sitting there in the archive, which is a more honest record of what fighting browser hijackers in 2004 was like than any of the press releases from the companies selling the fix.

~ what the fork kept ~

Open sourcing it in 2012 was Trend Micro doing the polite version of putting a product down, and the license turned out to matter. The code sat on SourceForge, someone picked it up, and HijackThis Fork has been shipping since, now under the name HijackThis+, with the entry classes extended for versions of Windows that did not exist when the original stopped.

The forum layer it depended on mostly went first. Windows itself absorbed the job around Windows 8 and 10, with the startup tab in Task Manager doing a friendlier version of an O4 dump, and by then the interesting attacks had moved somewhere a registry scan cannot see. What HijackThis was really documenting was a period when a home PC's problems were legible in a couple of hundred lines of text, and when the answer to them was another person reading it.

@}-->--

              )
             (_)
            .-'-.
            |   |
            |   |
            |   |
            |   |
          __|   |__   .-.
       .-'  |   |  `-:   :
      :     `---'     :-'
       `-._       _.-'
           '""""""

« previous  ·  random  ·  next »