How to post a HijackThis Log

Warning

HijackThis should only be used if your browser or computer is still having problems after running Spybot or another Spyware/Hijacker remover. HijackThis is an advanced tool, and therefore requires advanced knowledge about Windows and operating systems in general. If you delete items that it shows, without knowing what they are, it can lead to other problems such as your Internet no longer working or problems with running Windows itself. You should also attempt to clean the Spyware/Hijacker/Trojan with all other methods before using HijackThis. If you allow HijackThis to remove entries before another removal tool scans your computer, the files from the Hijacker/Spyware will still be left on your computer and future removal tools will not be able to find them.

If you do not have advanced knowledge about computers you should NOT fix entries using HijackThis without consulting an expert on using this program. If you have already run Spybot - S&D and Ad-Aware and are still having problems, then please continue with this tutorial and post a HijackThis log in our forums including details about your problem and we will advise you on what to fix.

There are a lot of images in this tutorial and for this I want to apologize to any dial-up users. I have kept the sizes of these images as small as possible so that it should not take a long time to open this document.

Step 1: Register an account at BleepingComputer.com

In order to post a log at BleepingComputer.com you need to have a registered account. If you already have a registered account, you can skip to Step 2.

To register an account visit the following link:

Register an account at BleepingComputer.com to post a HijackThis Log [Visit this link to register an account]

Once you fill out the form and press the the Submit my registration button, you will shortly receive an email with instructions on how to validate that account by either clicking on the enclosed link or following the alternate steps below that.

Once you have validated your account, you should continue to Step 2.

Step 2: Install HijackThis


Download HijackThis from the following download location:

HijackThis Download Link

When you click on the above link you will see a web page that looks similar to figure 1 below.

Figure 1: HijackThis Download Link

Simply click on the link designated by the red box in Figure 1 above. When you click on that you will get a download prompt similar to Figure 2 below.

Figure 2: HijackThis Save File dialog box

Make sure that you are saving the file, and not opening it, and then press the OK button. You will now be presented with a screen similar to Figure 3 below asking where you would like to save the file.

Figure 3: Save HJTInstall.exe to the desktop

Click once on the Desktop button, designated by the red box in the figure above, to save the file to your Desktop and then press the Save button. Your computer will now download the file to your computer and save it on your Desktop. When it is done downloading you will now find an icon on your desktop that looks like Figure 4 below.

Figure 4: HJTInstall.exe Icon

Double-click on this icon to start the installation process. Once you double-click the icon a new window will open that looks like Figure 5 below.

Figure 5: HijackThis Install Screen

Do not change any settings on this screen. Simply click once on the Install button designated by the red box in Figure 5 above. When you click on this button, the program will be extracted to C:\Program Files\Trend Micro\HijackThis. When it is completed you will see a screen similar to Figure 6 below.

Figure 6: HijackThis has successfully been extracted

Press the OK button and you will now see a screen similar to Figure 5 above. This time press the Close button to close the installation program. You will now be back at your desktop.

Step 3: Start HijackThis

After HijackThis is installed, it will automatically start. If this does not happen, or you would like to start it again at a later time, you should follow these steps. Otherwise, skip to Step 4. Now that HijackThis has been installed we want to start the program. First we need to navigate to the directory that it was installed to.

Click on the Start Menu and then click on the My Computer link. When My Computer opens, you will see a screen similar, it may look different on your computer, to Figure 7 below.

Figure 7: My Computer

Double-click on the C: drive to open it up. The C: drive may be labeled different than in the image above. Once you double-click on the C: drive you will see a screen similar to Figure 8 below.

Figure 8: Program Files

Locate the folder named Program Files and double-click it with your mouse in order to open that folder. Once you double-click on the Program Files folder you will see a screen similar to Figure 9 below.

Figure 9: Open the Trend Micro folder

Locate the folder named Trend Micro and double-click it with your mouse in order to open that folder. Once you double-click on the Trend Micro you will see a screen similar to Figure 10 below.

Figure 10: Open the HijackThis folder

Locate the folder named HijackThis and double-click it with your mouse in order to open that folder. Once you double-click on the HijackThis folder you will see a screen similar to Figure 11 below.

Figure 11: HijackThis icon

Double-click on the HijackThis.exe icon to launch the program. It may not have the .exe extension but should look like the icon above. Once you double-click on the icon, HijackThis will be launched. We will continue with our instructions in the next step.

Step 4: Using HijackThis

Now that HijackThis is launched you will see a screen similar to figure 12 below.

Figure 12: Startup Screen for HijackThis

The first thing you should do at this point is remove the checkmark in the checkbox labeled Show this window when I start HijackThis.This will make it so you never see this startup screen again. I am having you change this option because most people who will help you will give instructions that do not account for this screen and could cause some confusion. Once you have put a checkmark in that box, press the button labeled None of the above, just start the program. You will now be presented with the main screen of HijackThis and it will look similar to Figure 13 below.

Figure 13: Main HijackThis Screen

At this screen press the scan button and you will be presented with a window showing a list of entries. At the bottom of this window you will see the following.

Figure 14: Save your HijackThis log

Press the Save log button, designated by the red box in Figure 14 above, to save your log to your computer and open it. When you press the save button, you will be presented with a screen similar to figure 3 above. Simply press the Desktop button to save it to your desktop and then press the Save button. The log is now saved to your desktop and is opened in notepad. You will now see a screen similar to Figure 15 below.

Figure 15: Your HijackThis Log

Click the Format menu and make sure that Wordwrap is not checked. If it is checked then click on it to uncheck it. You should now click on the Edit menu and then click on the Select All menu option as shown in Figure 16 below.

Figure 16: Select All

When you click on the Select All menu option all the text in the notepad will become highlighted. You should now click on the Edit menu and then click on the Copy menu option as shown in Figure 17 below.

Figure 17: Copy the log to the Windows clipboard

Step 5: Post the HijackThis Log at BleepingComputer.com

Now that the log is copied to the Windows clipboard we want to paste that into a new topic on Bleeping Computer. Click on the following link to start posting your log:

Post your HijackThis Log at BleepingComputer.com [Click this link to post a log]

Your web browser will open and you will see a web page with a form asking you to fill in information to post. Below you will find images of parts of this page that you are required to fill.

Example 1 - Topic Title and Description

Example 2 - Topic Title and Description

The next part that you must fill out is the actual message of the post. An example of the message area appears below:

Figure 18: Topic Message Area

In the white message area, as shown above, write a brief description of your problem and then press the enter key. Then right click in the white area below your description of your problem and select paste. Your HijackThis log will now be pasted in the message box below the description of your problem.

In order to get notified of a reply to your topic, you want to set the topic to email you when someone replies to it. Make sure that you have all the items checked as shown in Figure 19 below.

Figure 19: Topic Options

Finally, we submit the topic containing your HijackThis log to the site by pressing the Post New Topic button as shown in Figure 20 below.

Figure 20: Post your topic

Your log is now posted at BleepingComputer.com. Someone will read it when they become available and get back to you as soon as possible. As long as you have followed these directions properly you will be notified when someone responds to you. When someone does respond to you, the email you receive will contain a link back to your topic. Simply click that link and you will see the reply to your original question/log. Follow the instructions that are given and then when you are ready to reply to that topic, you would press the Add Reply button as shown in Figure 21 below.

Figure 21: Add Reply Button

When you press that button you will be presented with a similar form that we just covered. Just enter the requested information by following the steps contained in this tutorial.

I hope that this tutorial helps to make your submission of HijackThis logs an easier process. As always if you have any question, do not hesitate to ask them in our computer help forums.

--
Lawrence Abrams & Phawgg
Bleeping Computer: How to use Bleeping Computer
BleepingComputer.com: Computer Help & Tutorials for the beginning computer user.