2.10.0.30

 - Fixed potential error in retrieving paths of executable images on Windows 8.1- due to OS bug (thanks to HackerVlad).
 - TamperProtection will show an error code instead of the number 0 if an access is denied.
 - Fixed freezing for 15 seconds on Windows 10+ when checking BITS.

src/HiJackThis-update-test.txt

@@ -1 +1 @@
-2.10.0.29
+2.10.0.30

src/HiJackThis-update.txt

@@ -1 +1 @@
-2.10.0.29
+2.10.0.30

src/XmlDocument.cls

@@ -40,15 +40,32 @@ End Sub
 
 Public Function LoadFile(sFilePath As String) As Boolean
     On Error GoTo Err_Trap
-
-    Dim hFile           As Integer
+    
+    Dim ff              As Integer
     Dim sFileData       As String
+    Dim iSize           As Long
+    ReDim b(1) As Byte
 
-    hFile = FreeFile()
-    Open sFilePath For Binary Access Read As #hFile
-    sFileData = String$(LOF(hFile), vbNullChar)
-    Get #hFile, , sFileData
-    Close #hFile
+    ff = FreeFile()
+    Open sFilePath For Binary Access Read As ff
+    iSize = LOF(ff)
+    If iSize >= 2 Then
+        Get #ff, , b
+    End If
+    If b(0) = &HFF& And b(1) = &HFE& Then
+        If Not EOF(ff) Then
+            sFileData = String$(iSize - 1, vbNullChar)
+            Get #ff, , sFileData
+            sFileData = StrConv(sFileData, vbFromUnicode)
+        End If
+    Else
+        Seek #ff, 1
+        If Not EOF(ff) Then
+            sFileData = String$(iSize, vbNullChar)
+            Get #ff, , sFileData
+        End If
+    End If
+    Close #ff
 
     If Len(sFileData) = 0 Then Exit Function
 
@@ -65,19 +82,18 @@ Public Function LoadData(Data As String) As Boolean
 
     Dim bData() As Integer
     Dim isArrayAlloc As Boolean
+    Dim posTag As Long
 
-    ' Map Data to a Double-Byte Array
-
     If Len(Data) = 0 Then
         'Err.Raise 13 & vbObjectError, "vbXml", "Unable to Parse Empty Data" ' Type Mismatch
         Exit Function
     End If
 
-    'UTF16 ?
-    If HasBOM_UTF16(Data) Then
-        Data = StrConv(Mid$(Data, 3), vbFromUnicode)
-    End If
+    posTag = InStr(1, Data, "<")
+    If posTag = 0 Then Exit Function
+    If posTag > 1 Then Data = Mid$(Data, posTag) 'trim BOM
 
+    ' Map Data to a Double-Byte Array
     Dim tArrDesc    As SAFEARRAY1D
     With tArrDesc
         .pvData = StrPtr(Data)

src/XmlUtil.bas

@@ -5,14 +5,19 @@ Attribute VB_Name = "XmlUtil"
 ' XML Parser by Jason Thorn (Fork by Alex Dragokas)
 '
 
+' Fork v1.6 [25.04.2023]
+' - Fixed UTF16LE detection on MBCS locale
+'
+' Fork v1.5 [24.07.2022]
+' - Fixed incorrect decoding of multibyte characters
+'
 ' Fork v1.4
 ' - added .NodeValueByName
 ' - removed err.raise when trying to parse empty file
 ' - added .LoadFile method (returns FALSE, if error happens, or file is empty.
 ' - .LoadData is now a function (TRUE, if success with loading)
 ' - improved UTF16 LE format detection.
 '
-
 ' Fork v1.3 [28.11.2017]
 ' - added all possible error handlers
 ' - replaced error handlers based on Err.raise by separate function (ErrorMsg), just because I don't like at all when class raises runtime error.

src/_9_upload_git.cmd

@@ -17,7 +17,7 @@ set "ch="
 set /p "ch=Would you like to write hot-update.txt ? (Y/N)"
 if /i "%ch%" neq "n" (
   start "" hot-changelog.txt
-  start "" ChangeLog\_TODO_HiJackThis.txt
+  start "" _ChangeLog_en.txt
 )
 
 "C:\Program Files\Git\bin\sh.exe" --login -i -- "upload.sh"

src/_ChangeLog_en.txt

@@ -11,6 +11,11 @@ Version history:
 ||||||||       1. HiJackThis: changelog         |||||||||||
 ===========================================================
 
+[2.10.0.30] - May 06, 2023
+ - Fixed potential error in retrieving paths of executable images on Windows 8.1- due to OS bug (thanks to HackerVlad).
+ - TamperProtection will show an error code instead of the number 0 if an access is denied.
+ - Fixed freezing for 15 seconds on Windows 10+ when checking BITS.
+
 [2.10.0.29] - Apr 14, 2023
  - Added O7 - AutoLogon.
  - O7 - TroubleShooting (EV): [PathExt] and [PSModulePath] moved to "Missing list" method, which means item is displayed if only system defaults missing.
@@ -1673,4 +1678,4 @@ saved and edited in Wordpad.
 
 [v1.00]
 * Original release, later added copy to clipboard button
-
+                                                                                                       

src/_ChangeLog_ru.txt

@@ -11,6 +11,11 @@
 ||||||||       1. HiJackThis: список изменений         |||||||||||
 ==================================================================
 
+[2.10.0.30] - 06.05.2023
+ - Исправлена потенциальная ошибка при получении путей к исполняемым образам на Windows 8.1- из-за бага в ОС (спасибо HackerVlad).
+ - TamperProtection будет показывать код ошибки вместо числа 0, если получен отказ в доступе.
+ - Исправлено подвисание на 15 сек. в Windows 10+ при проверке BITS.
+
 [2.10.0.29] - 14.04.2023
  - Добавлен O7 - AutoLogon.
  - O7 - TroubleShooting (EV): для [PathExt] и [PSModulePath] изменён метод проверки на "Missing list", т.е. элемент выводится только, если не хватает системной записи по умолчанию.
@@ -1673,4 +1678,4 @@ ProcMan - добавлено сохранение списка модулей, 
 
 [v1.00]
 * Первый релиз, позднее добавлена кнопка копирования в буфер обмена
-
+                                                                                         

src/_HijackThis.vbp

@@ -39,7 +39,7 @@ Form=frmCheckDigiSign.frm
 Form=frmSysTray.frm
 Form=frmADSspy.frm
 Form=frmProcMan.frm
-Form=frmStartupList2.frm
+Form=..\..\���� ����������\HiJackThis\frmStartupList2.frm
 Class=clsStringBuilder; clsStringBuilder.cls
 Class=clsTimer; clsTimer.cls
 Class=clsMath; clsMath.cls
@@ -77,7 +77,7 @@ Description="Creates a report of non-standard parameters of registry and file sy
 CompatibleMode="0"
 MajorVer=2
 MinorVer=10
-RevisionVer=29
+RevisionVer=30
 AutoIncrementVer=0
 ServerSupportFiles=0
 VersionCompanyName="Stanislav Polshyn & Trend Micro Inc."