5.4 Analyzing Your Hijack This logs

The Hijackthis log entries are more complicated than you might expect. If you’ve never seen them, here is an overview of the log entries and what they mean:

R0, R1, R2, R3 - Internet Explorer Start/Search pages URLs

F0, F1 - Autoloading programs

N1, N2, N3, N4 - Netscape/Mozilla Start/Search pages URLs

O1 - Hosts file redirection

O2 - Browser Helper Objects

O3 - Internet Explorer toolbars

O4 - Autoloading programs from Registry

O5 - IE Options icon not visible in Control Panel

O6 - IE Options access restricted by Administrator

O7 - Regedit access restricted by Administrator

O8 - Extra items in IE right-click menu

O9 - Extra buttons on main IE button toolbar, or extra items in IE 'Tools' menu

O10 - Winsock hijacker

O11 - Extra group in IE 'Advanced Options' window

O12 - IE plugins

O13 - IE DefaultPrefix hijack

O14 - 'Reset Web Settings' hijack

O15 - Unwanted site in Trusted Zone

O16 - ActiveX Objects (aka Downloaded Program Files)

O17 - Lop.com domain hijackers

O18 - Extra protocols and protocol hijackers

O19 - User style sheet hijack

O20 - AppInit_DLLs Registry value autorun

O21 - ShellServiceObjectDelayLoad Registry key autorun

O22 - SharedTaskScheduler Registry key autorun

O23 - Windows NT Services

Not everything that shows up in the HijackThis Logs is bad and not everything needs to be removed.In fact, it is almost guaranteed that some of the items in your HijackThis logs will be legitimate software and removing those is not a good idea since it might harm your system or even make it inoperable.   

Using HijackThis is something like trying to weed out the Windows Registry yourself. It’s not something you should do - unless you know what you’re doing.

<< Chapter 5.3 - Run Hijack This | Chapter 6 - Preventing Spyware Infections >>