The Malware Helper Workflow Tool was written by Billy O'Neal in 2008 to aid HijackThis team members in saving and using preset 'speeches' in order to produce useful and detailed instructions for people that have posted for help for malware removal. This is done by creating an extremely easy to navigate interface that is able to not only combine the speeches together at a helper's click, but also allows for extra information to be stored about each user (such as current issues, logs, notes, etc.) so that the malware helper can interact with the user on a more personal level.
In 2009, development of this program was taken over by Aommaster, who further added features such as the BBCode to HTML parser, multi-select list boxes and timers to count how long since the last user's post. Also, additional customization features were added such as the ability to change what the log summary looks like through the Global Settings.
Upon the first startup of the program, two elements are created; a file called data.db and a registry entry located at HKey_Current_User\SOFTWARE\BillyOneal\MHWT. The two elements are explained below:
data.db: This file stores all program information from speeches, user information, and customization information (such as greeting messages, log formats, etc.). This is an essential part of the program. Without it, the Malware Helper Workflow Tool is unable to function.
Registry Key: This key stored window position and size information, so that when the program is re-opened, previous sizing information is recalled and windows open at the same size they were set to open at. This is not a vital element, and hence, if the registry cannot be written to, it won't affect the overall running of the program.
The consequence of using such few elements is that the Malware Helper Workflow Tool is portable. As long as the helper moves their data.db file along with the program, the program can run on any computer using the .NET framework.
During the first run of the program, an error message shown below will be displayed:
It will also be followed by a message box with the address of the database. This is normal during the first run of the program, where it creates the database (data.db) file.
A screenshot of the main window is shown below:
Once the database has been created, you can run the MHWT. Note that on the first run, the following input box will be displayed:
You can enter the full-mode key that will be present on the private staff forums to unlock the syntax guide. Note that no other program functionality is lost if full mode is not enabled.
If you are a malware removal student, you can begin using the MHWT with full mode disabled. Once you have graduated, you can obtain the full-mode key and enable full-mode by clicking Help > Enable Full-Mode.