The New Tech - View Single Post - HijackThis Log: Self-Guide

**DaveMo~** · Oct 28, 2005, 10:30pm

Credit: HijackThis, a great protection program known the world over, was created by Merijn Bellekom. He has also created some other really good programs (like CWShredder). Click here to visit his website. If you like his FREE programs, you can donate here.

Caution: Do NOT fix any items in your HijackThis log unless you are absolutely sure of what you are fixing. Many of the list items are necessary for the functioning of your PC.

This is a simple guide to explain what the notations mean in your HijackThis log and is not meant to replace asking for help. However, study of this list, along with the mentioned web sites can help with understanding the log and learning how to do the fixes.

Listed below are the possible entries into your log. A more in-depth explanation will follow.

R0, R1, R2, R3 - Internet Explorer Start/Search pages URLs
F0, F1 - Autoloading programs
N1, N2, N3, N4 - Netscape/Mozilla Start/Search pages URLs
O1 - Hosts file redirection
O2 - Browser Helper Objects
O3 - Internet Explorer toolbars
O4 - Autoloading programs from Registry
O5 - IE Options icon not visible in Control Panel
O6 - IE Options access restricted by Administrator
O7 - Regedit access restricted by Administrator
O8 - Extra items in IE right-click menu
O9 - Extra buttons on main IE button toolbar, or extra items in IE 'Tools' menu
O10 - Winsock hijacker
O11 - Extra group in IE 'Advanced Options' window
O12 - IE plugins
O13 - IE DefaultPrefix hijack
O14 - 'Reset Web Settings' hijack
O15 - Unwanted site in Trusted Zone
O16 - ActiveX Objects (aka Downloaded Program Files)
O17 - Lop.com domain hijackers
O18 - Extra protocols and protocol hijackers
O19 - User style sheet hijack

Included in the HijackThis program is a listing of all possible log items.

The different sections of hijacking possibilities have been separated into these groups:
R - Registry, StartPage/SearchPage changes
R0 - Changed registry value
R1 - Created registry value
R2 - Created registry key
R3 - Created extra registry value where only one should be
F - IniFiles, autoloading entries
F0 - Changed inifile value
F1 - Created inifile value
F2 - Changed inifile value, mapped to Registry
F3 - Created inifile value, mapped to Registry
N - Netscape/Mozilla StartPage/SearchPage changes
N1 - Change in prefs.js of Netscape 4.x
N2 - Change in prefs.js of Netscape 6
N3 - Change in prefs.js of Netscape 7
N4 - Change in prefs.js of Mozilla
O - Other, several sections which represent:
O1 - Hijack of auto.search.msn.com with Hosts file
O2 - Enumeration of existing MSIE BHO's
O3 - Enumeration of existing MSIE toolbars
O4 - Enumeration of suspicious autoloading Registry entries
O5 - Blocking of loading Internet Options in Control Panel
O6 - Disabling of 'Internet Options' Main tab with Policies
O7 - Disabling of Regedit with Policies
O8 - Extra MSIE context menu items
O9 - Extra 'Tools' menuitems and buttons
O10 - Breaking of Internet access by New.Net or WebHancer
O11 - Extra options in MSIE 'Advanced' settings tab
O12 - MSIE plugins for file extensions or MIME types
O13 - Hijack of default URL prefixes
O14 - Changing of IERESET.INF
O15 - Trusted Zone Autoadd
O16 - Download Program Files item
O17 - Domain hijack
O18 - Enumeration of existing protocols and filters
O19 - User stylesheet hijack
O20 - AppInit_DLLs autorun Registry value
O21 - ShellServiceObjectDelayLoad (SSODL) autorun Registry key
O22 - SharedTaskScheduler autorun Registry key
O23 - This section corresponds to XP,NT, 2003, and 2003 services

Work in progress....more information to follow about the list items.

Dave

Oct 28, 2005, 10:30pm	HijackThis Log: Self-Guide
DaveMo~ Witty Title Posts: 1,548 Name: Dave Karma:	*Credit: HijackThis, a great protection program known the world over, was created by Merijn Bellekom.* He has also created some other really good programs (like CWShredder). Click here to visit his website. If you like his FREE programs, you can donate here. Caution: Do NOT fix any items in your HijackThis log unless you are absolutely sure of what you are fixing. Many of the list items are necessary for the functioning of your PC. This is a simple guide to explain what the notations mean in your HijackThis log and is not meant to replace asking for help. However, study of this list, along with the mentioned web sites can help with understanding the log and learning how to do the fixes. Listed below are the possible entries into your log. A more in-depth explanation will follow. R0, R1, R2, R3 - Internet Explorer Start/Search pages URLs F0, F1 - Autoloading programs N1, N2, N3, N4 - Netscape/Mozilla Start/Search pages URLs O1 - Hosts file redirection O2 - Browser Helper Objects O3 - Internet Explorer toolbars O4 - Autoloading programs from Registry O5 - IE Options icon not visible in Control Panel O6 - IE Options access restricted by Administrator O7 - Regedit access restricted by Administrator O8 - Extra items in IE right-click menu O9 - Extra buttons on main IE button toolbar, or extra items in IE 'Tools' menu O10 - Winsock hijacker O11 - Extra group in IE 'Advanced Options' window O12 - IE plugins O13 - IE DefaultPrefix hijack O14 - 'Reset Web Settings' hijack O15 - Unwanted site in Trusted Zone O16 - ActiveX Objects (aka Downloaded Program Files) O17 - Lop.com domain hijackers O18 - Extra protocols and protocol hijackers O19 - User style sheet hijack Included in the HijackThis program is a listing of all possible log items. The different sections of hijacking possibilities have been separated into these groups: R - Registry, StartPage/SearchPage changes R0 - Changed registry value R1 - Created registry value R2 - Created registry key R3 - Created extra registry value where only one should be F - IniFiles, autoloading entries F0 - Changed inifile value F1 - Created inifile value F2 - Changed inifile value, mapped to Registry F3 - Created inifile value, mapped to Registry N - Netscape/Mozilla StartPage/SearchPage changes N1 - Change in prefs.js of Netscape 4.x N2 - Change in prefs.js of Netscape 6 N3 - Change in prefs.js of Netscape 7 N4 - Change in prefs.js of Mozilla O - Other, several sections which represent: O1 - Hijack of auto.search.msn.com with Hosts file O2 - Enumeration of existing MSIE BHO's O3 - Enumeration of existing MSIE toolbars O4 - Enumeration of suspicious autoloading Registry entries O5 - Blocking of loading Internet Options in Control Panel O6 - Disabling of 'Internet Options' Main tab with Policies O7 - Disabling of Regedit with Policies O8 - Extra MSIE context menu items O9 - Extra 'Tools' menuitems and buttons O10 - Breaking of Internet access by New.Net or WebHancer O11 - Extra options in MSIE 'Advanced' settings tab O12 - MSIE plugins for file extensions or MIME types O13 - Hijack of default URL prefixes O14 - Changing of IERESET.INF O15 - Trusted Zone Autoadd O16 - Download Program Files item O17 - Domain hijack O18 - Enumeration of existing protocols and filters O19 - User stylesheet hijack O20 - AppInit_DLLs autorun Registry value O21 - ShellServiceObjectDelayLoad (SSODL) autorun Registry key O22 - SharedTaskScheduler autorun Registry key O23 - This section corresponds to XP,NT, 2003, and 2003 services Work in progress....more information to follow about the list items. Dave