p02 HijackThis
p02 HijackThis
p02 HijackThis
A trusted computer running any version of Windows, with Internet access. You need administrator privileges on the computer.
10 Points
Start a machine. Each machine in S214 has many operating systems, and you can use any of them. For this project, I recommend that you use Vista or Windows 7 Beta. Log in as Student with no password.
Warning! "Ethical Hacking and Network Defense" students will capturing passwords in room S214. Don't do online shopping, personal e-mailing, or any other private computer work in that lab. Make up a new password just for that lab. Nothing you do in that lab is private!
Installing HijackThis
2. 3. 4. Open Firefox. Go to majorgeeks.com On the left side of the page, click Anti-Spyware. Scroll about halfway down through the long list and find HijackThis. Click the HijackThis link. Click one of the links in the DOWNLOADS section and follow the instructions on your screen to download HijackThis. If the download doesn't start, check to see if NoScript is blocking it. If you see the "Scripts Currently Forbidden" message at the bottom of the Firefox window, click the Options button and then click "Temporarily Allow All This Page". Save the hijackthis_sfx.exe file on your desktop. Minimize all windows. On your desktop, right-click the hijackthis_sfx.exe file and click "Run as Administrator". In the "Open File Security Warning" box, click Run. In the "User Account Control" box, click Yes. In the "WinZip Self-Installer" box, click Unzip. A box pops up saying "1 file(s) unzipped successfully". Click OK. Close the "WinZip Self-Installer" box. Click Start, Computer. Double-click the C: drive to open it. If you don't see the files or folders, click "Show contents". Double-click the "Program Files" folder. Double-click the "HijackThis" folder. Right-click the "HijackThis.exe" file and click "Run as Administrator". In the "User Account Control" box, click Yes. A HijackThis box pops up with a warning message. Read it and click OK. The main HijackThis box appears, as shown to the right on this page. Click the "Do a system scan and save a logfile" button.
5. 6. 7. 8. 9.
Running HijackThis
10. 11. 12. 13. 14. 15. 16.
Page 1 of 3
10 Points
18. 19.
A logfile appears in Notepad, with a long list of processes and registry keys, as shown to the right on this page. This list is hard to understand in this form, so we'll use a free online tool to interpret it. In Firefox, go to hijackthis.de At the bottom of the Firefox window, you should see a "Scripts Partially Allowed" message. Click the Options button and then click "Allow hijackthis.de". The page reloads, and the "Scripts Partially Allowed" message appears again, but it's OK now because the only scripts we need are the ones from hijackthis.de. Click in the Notepad window showing the log file. Press Ctrl+A to select all the text, and Ctrl+C to copy it to the Clipboard. In the Firefox window, in the hijackthis.de page, point to the large box titled "You can paste a logfile in this textbox". Right-click and click Paste. The text should appear in the box. In the hijackthis.de page, at the bottom, click the Analyze button. You should see a list of items found on your computer, with a graphical rating of each item's safety, as shown below on this page. This is very useful when trying to clean spyware off infected computers!
Page 2 of 3
10 Points
Make sure the hijackthis.de Web page is open, showing some of the items from your machine with safety ratings. Press the PrintScrn key in the upper-right portion of the keyboard. That will copy the whole desktop to the clipboard. Click Start. Type PAINT. Click Paint. Click in the Paint window and press Ctrl+V. Save the image with the filename Your Name Proj 2. Select a Save as type of JPEG. Email the JPEG image to me as an attachment to an e-mail message. Send it to: cnit.120@gmail.com with a subject line of "Proj 2 From Your Name", replacing Your Name with your own first and last name. Send a Cc to yourself.
Last Modified: 7-31-11
Page 3 of 3