Hijack This Tutorial (the program may be downloaded from here)
This article is for advanced users.
If you are not familiar with running processes on your computer as well as anything ever installed that could tie into your web browser, it will not be much help to you.

Finally, Hijack This has been taken over by Trend Micro. This new version can be downloaded here.

You should have scanned your machine with anti-spyware, virus and Trojan tools before using Hijack This.

This article is meant for those wishing to learn more about what HijackThis is showing you and how to analyze logs yourself. It is not really meant for novices. It is meant to be more educational for intermediate to advanced PC users.

Below explains what each section means and each of these sections are broken down with examples to help you understand what is safe and what should be removed. 
 

Official Hijack This Tutorial:

What to do:
If you recognize the URL at the end as your homepage or search engine, it's OK. If you don't, check it and have HijackThis fix it.
For the R3 items, always fix them unless it mentions a program you recognize, like Copernic.

What to do:
The F0 items are always bad, so fix them.
The F1 items are usually very old programs that are safe, so you should find some more info on the filename to see if it's good or bad.
Pacman's Startup List can help with identifying an item.

What to do:
Usually the Netscape and Mozilla homepage and search page are safe. They rarely get hijacked, only Lop.com has been known to do this. Should you see an URL you don't recognize as your homepage or search page, have HijackThis fix it.

What to do:
This hijack will redirect the address to the right to the IP address to the left. If the IP does not belong to the address, you will be redirected to a wrong site everytime you enter the address. You can always have HijackThis fix these, unless you knowingly put those lines in your Hosts file.
The last item sometimes occurs on Windows 2000/XP with a Coolwebsearch infection. Always fix this item, or have CWShredder repair it automatically.

What to do:
If you don't directly recognize a Browser Helper Object's name, use TonyK's BHO & Toolbar List to find it by the class ID (CLSID, the number between curly brackets) and see if it's good or bad. In the BHO List, 'X' means spyware and 'L' means safe.

What to do:
If you don't directly recognize a toolbar's name, use TonyK's BHO & Toolbar List to find it by the class ID (CLSID, the number between curly brackets) and see if it's good or bad. In the Toolbar List, 'X' means spyware and 'L' means safe.
If it's not on the list and the name seems a random string of characters and the file is in the 'Application Data' folder (like the last one in the examples above), it's probably Lop.com, and you definately should have HijackThis fix it.

What to do:
Use PacMan's Startup List to find the entry and see if it's good or bad.
If the item shows a program sitting in a Startup group (like the last item above), HijackThis cannot fix the item if this program is still in memory. Use the Windows Task Manager (TASKMGR.EXE) to close the process prior to fixing.

What to do:
Unless you or your system administrator have knowingly hidden the icon from Control Panel, have HijackThis fix it.

What to do:
Unless you have the Spybot S&D option 'Lock homepage from changes' active, or your system administrator put this into place, have HijackThis fix this.

What to do:
Always have HijackThis fix this, unless your system administrator has put this restriction into place.

What to do:
If you don't recognize the name of the item in the right-click menu in IE, have HijackThis fix it.

What to do:

If you don't recognize the name of the button or menuitem, have HijackThis fix it.

What to do:

It's best to fix these using LSPFix from Cexx.org, or Spybot S&D from Kolla.de.
Note that 'unknown' files in the LSP stack will not be fixed by HijackThis, for safety issues.

 

O11 - Extra group in IE 'Advanced Options' window

What it looks like:

 

What to do:

The only hijacker as of now that adds its own options group to the IE Advanced Options window is CommonName. So you can always have HijackThis fix this.

 

O12 - IE plugins

What it looks like:

 

What to do:

Most of the time these are safe. Only OnFlow adds a plugin here that you don't want (.ofb).

 

O13 - IE DefaultPrefix hijack

What it looks like:

 

What to do:

These are always bad. Have HijackThis fix them.

 

O14 - 'Reset Web Settings' hijack

What it looks like:

 

What to do:

If the URL is not the provider of your computer or your ISP, have HijackThis fix it.

 

O15 - Unwanted sites in Trusted Zone

What it looks like:

 

What to do:

Most of the time only AOL and Coolwebsearch silently add sites to the Trusted Zone. If you didn't add the listed domain to the Trusted Zone yourself, have HijackThis fix it.

 

O16 - ActiveX Objects (aka Downloaded Program Files)

What it looks like:

 

What to do:

If you don't recognize the name of the object, or the URL it was downloaded from, have HijackThis fix it. If the name or URL contains words like 'dialer', 'casino', 'free_plugin' etc, definitely fix it.
Javacool's SpywareBlaster has a huge database of malicious ActiveX objects that can be used for looking up CLSIDs. (Right-click the list to use the Find function.)

 

O17 - Lop.com domain hijacks

What it looks like:

 

What to do:

If the domain is not from your ISP or company network, have HijackThis fix it. The same goes for the 'SearchList' entries.
For the 'NameServer' (DNS servers) entries, Google for the IP or IPs and it will be easy to see if they are good or bad.

 

O18 - Extra protocols and protocol hijackers

What it looks like:

 

What to do:

Only a few hijackers show up here. The known baddies are 'cn' (CommonName), 'ayb' (Lop.com) and 'relatedlinks' (Huntbar), you should have HijackThis fix those.
Other things that show up are either not confirmed safe yet, or are hijacked (i.e. the CLSID has been changed) by spyware. In the last case, have HijackThis fix it.

 

O19 - User style sheet hijack

What it looks like:

 

What to do:

In the case of a browser slowdown and frequent popups, have HijackThis fix this item if it shows up in the log. However, since only Coolwebsearch does this, it's better to use CWShredder to fix it.

 

O20 - AppInit_DLLs Registry value autorun

What it looks like:

 

What to do:
This Registry value located at

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows

loads a DLL into memory when the user logs in, after which it stays in memory
until logoff. Very few legitimate programs use it (Norton CleanSweep uses
APITRAP.DLL), most often it is used by trojans or agressive browser hijackers.

In case of a 'hidden' DLL loading from this Registry value (only visible when
using 'Edit Binary Data' option in Regedit) the dll name may be prefixed with
a pipe '|' to make it visible in the log.

O21 - ShellServiceObjectDelayLoad Registry key autorun

What it looks like:
 

What to do:
This is an undocumented autorun method, normally used by a few Windows system
components. Items listed at

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\
ShellServiceObjectDelayLoad

are loaded by Explorer when Windows starts. HijackThis uses a whitelist
of several very common SSODL items, so whenever an item is displayed in
the log it is unknown and possibly malicious. Treat with extreme care.

What to do:
This is an undocumented autorun for Windows NT/2000/XP only, which
is used very rarely. So far only CWS.Smartfinder uses it. Treat with care.

What to do:
 

Quote:

This is the listing of non-Microsoft services. The list should be the same as the one you see in the Msconfig utility of Windows XP. Several trojan hijackers use a homemade service in adittion to other startups to reinstall themselves. The full name is usually important-sounding, like 'Network Security Service', 'Workstation Logon Service' or 'Remote Procedure Call Helper', but the internal name (between brackets) is a string of garbage, like 'O?’ŽrtñåȲ$Ó'. The second part of the line is the owner of the file at the end, as seen in the file's properties. Note that fixing an O23 item will only stop the service and disable it. The service needs to be deleted from the Registry manually or with another tool. In HijackThis 1.99.1 or higher, the button 'Delete NT Service' in the Misc Tools section can be used for this.

Comments

Add New Search RSS

Write comment
Name:
Email:	do not notifynotify
Website:
Title:
UBBCode:	-color-aquablackbluefuchsiagraygreenlimemaroonnavyolivepurpleredsilvertealwhiteyellow -size-tinysmallmediumlargehuge
	Please input the anti-spam code that you can read in the image.

Powered by !JoomlaComment 3.26

3.26 Copyright (C) 2008 Compojoom.com / Copyright (C) 2007 Alain Georgette / Copyright (C) 2006 Frantisek Hliva. All rights reserved."