How to read HijackThis Log

Ever wondered how your HijackThis logs are interpreted and solution is given to you by experts/forum members???

Check below – This should simplify HijackThis for u.


Each line in a HijackThis log starts with a section name. (For technical information on this, click ‘Info’ in the main window and scroll down. Highlight a line and click ‘More info on this item’.) For practical information, click the section name you need help with:

  • R0, R1, R2, R3 – Internet Explorer Start/Search pages URLs
  • F0, F1 – Autoloading programs
  • F2, F3 – Autoloading programs mapped to the Registry
  • N1, N2, N3, N4 – Netscape/Mozilla Start/Search pages URLs
  • O1 – Hosts file redirection
  • O2 – Browser Helper Objects
  • O3 – Internet Explorer toolbars
  • O4 – Autoloading programs from Registry
  • O5 – IE Options icon not visible in Control Panel
  • O6 – IE Options access restricted by Administrator
  • O7 – Regedit access restricted by Administrator
  • O8 – Extra items in IE right-click menu
  • O9 – Extra buttons on main IE button toolbar, or extra items in IE ‘Tools’ menu
  • O10 – Winsock hijacker
  • O11 – Extra group in IE ‘Advanced Options’ window
  • O12 – IE plugins
  • O13 – IE DefaultPrefix hijack
  • O14 – ‘Reset Web Settings’ hijack
  • O15 – Unwanted site in Trusted Zone
  • O16 – ActiveX Objects (aka Downloaded Program Files)
  • O17 – domain hijackers
  • O18 – Extra protocols and protocol hijackers
  • O19 – User style sheet hijack
  • O20 – AppInit_DLLs Registry value autorun
  • O21 – ShellServiceObjectDelayLoad (SSODL) autorun Registry key
  • O22 – SharedTaskScheduler autorun Registry key
  • O23 – Services
  • O24 – ActiveX Desktop Components


Also visit HERE

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s