This article was taken from:
Please login or register to download
or
Use alternative full direct 100Mbit download
Understanding and Interpreting HijackThis Entries
A word of caution:
This program should be used with utmost caution as most of the entries shown after the scan will be necessary for smooth running of the operating system. All users are not expected to understand all of the entries it produces as it requires certain level of expertize. Unless you can spot a spyware program by the names of its Registry keys and DLL files it is best left to those specifically trained in interpreting the HijackThis logs. It is recommended that you reproduce the log file generated by HijackThis on "Windows O/S Support" which is dedicated for this cause.
It should be noted that Astalavista takes no responsibility for your mistakes. If you are unsure, LEAVE THE ENTRY ALONE!! If you delete the wrong thing, even a restore point will not help. This is to be used as learning only. If you would like help, post your HiJackThis log in "Windows O/S Support" and you shall recieve professional help in your malware problems.
Download a copy of HijackThis and save it to your desktop in a folder. Do a scan and save the HijackThis logfile. Do not remove anything. Post your log file in "Windows O/S Support".
Link to HijackThis
Please login or register to download
or
Use alternative full direct 100Mbit download
A staff member from this section will help you. Only staff members are allowed to reply to posts here in Windows O/S Support.
HijackThis Tutorial - Analyze, Understand and Interpret HijackThis logs
The first part of the log is commonly referred as the "Header" information. This contains details about the version of HijackThis, Windows and Internet Explorer alongwith the date and time of the scan. This information is crucial to the helper if you decide to post your log at one of the online help forums. This mainly lets the helper confirm that you have the latest versions of the mentioned software and also to tailor his reply suitable to the specific version of Windows.
The next part of the log contains a list of currently running processes which will vary with each HijackThis scan as it depends on what a particular user is running at the time of the scan. This may reveal the presence of malware. Some examples of running processes are:
An experienced HijackThis adept will know from the name of the exe file whether it pertains to a legitimate Windows program or to an unwanted software. The file name may be used to research the entry in Google or in specific sites which provide the information on known running processes. Couple of sites which provide such information are:
Please login or register to download
or
Use alternative full direct 100Mbit download
Please login or register to download
or
Use alternative full direct 100Mbit download
Following the processes list is the main body of HijackThis log. Each line in a HijackThis log starts with a section name, in the form of two-charecter numeric or alpha numeric code. The codes and corresponding section in IE or various registry entries are given below followed by explanation about the each entry.
A registry value that has been changed from the default, resulting in a changed Internet explorer start page, search page, search bar page, search assistant, search url, customize search etc. HijackThis monitors the following registry keys among others for changes;
Example of R0 entries from HijackThis logs
Recommendation:
The key in these R0 entries tagged by HijackThis are the URL's shown in each entry. If you don't recognize the URL or there are no URL's at the end of the entry, it can be safely fixed with HijackThis. Further, the URL's may be researched for CWS infection by using the known CWS Domains List.
R1 - Internet Explorer Start page/search page/search bar/search assistant URL
A registry value that has been created and is not present in a default windows install nor needed, possibly resulting in a changed Internet Explorer start page, search page, search bar page, search assistant, search url, customize search etc. HijackThis monitors the above mentioned registry keys in addition to
Example of R1 entries from HijackThis logs
Recommendation:
The same rule as for R0 entries applies. The Key to look for are the URL"s. If you don't recognize the URL or there are no URL's at the end of the entry, it can be safely fixed with HijackThis. Also research for CWS infection by using the CWS Domain List.
Please login or register to download
or
Download here directly at 100Mbit
R2 - This is not used
Merijn, the author of HijackThis wrote:
R3 - Default URL Searchhook
URLSearchHook is called by the browser when the browser cannot determine the protocol of a URL address.. When attempting to browse to a URL address that does not contain a protocol, Internet Explorer first attempts to determine the correct protocol using the unmodified address. If this fails, Internet Explorer creates URL Search Hook objects that have been registered, and calls each object's translate method until the URL has been translated or until all hooks have been called. Normally there should be only one value in this key.
URL Search Hooks are registered by adding a value that contains the object's class identifier (CLSID) string under the following key in the registry:
Many IE hijackers will add their UrlSearchHook to your system so every time when you type a url without protocol, you will be redirected to the hijacker's site. HijackThis tags this, if the default search hook value is changed, missing or a new value added in the above key.
Example of R3 entries from HijackThis logs.
Recommendation:
Generally it's safe to have HijackThis fix this entry.
This is one of the way, out of many different possible ways, Malware can automatically start and run in your system. HijackThis targets the "shell=" line in the system.ini file in your windows folder. The default legitimate line should read as "shell=explorer.exe". However malware like trojans, viruses etc., use this line to execute themselves at startup, for example Dumaru.Y Worm , W32.HLLW.Caspid worm and Subseven Trojan. This is achieved by adding an entry to the "shell=" line, like this,
So that when the system boots, the worm is also set to start alongwith explorer.exe. It is to be noted that in windowsNT based systems, the shell line is not located in the ini files but in the registry. Typically, in the "shell" string value of
whose contents again should be just "Explorer.exe". HijackThis tags this, if the line contains more than just "Explorer.exe" and restores the default value if you choose to fix it.
Example of F0 entries from HijackThis logs
Recommendation:
Unless you are running one of those shell changing programs which changes the default windows interface (explorer.exe) to one of its own, F0 entries are most probably bad, fix them always.
F1 - Autoloading programs from win.ini file
Like F0 entries, HijackThis targets "win.ini" file, one of the possible autoloading location for both valid programs and a lot of viruses use to run at startup.
Any filename after the run or load= will start everytime you boot into windows. Seperated by semicolons, multiple programs may be started using this method.
In windows NT based systems this is once again found in the Registry:
HijackThis will tag all items listed in these locations.
Example of F1 entries from HijackThis logs
Recommendation:
As win.ini file is used by many older programs to auto start programs, you should be selective in fixing those entries with HijackThis. Try to find some more info on the filename to see if it's good or bad before deciding to fix it.
F2 & F3 - Autoloading programs from registry in windows NT based systems
On Windows NT based systems,most sections of the win.ini and system.ini files are mapped into the registry. That is to say, Windows intercepts certain requests to access these files and, instead,accesses the registry. To determine which sections are mapped in this way, refer to the registry key:
Note that although Windows NT based systems retains the Win.ini file for compatibility with older programs, it does not use the Load= and Run= lines in Win.ini itself.
Let's see what MS says about inifilemapping in windows NT resourcekit,
F2 entry in a HijackThis log also refers to the Userinit value in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon and by default, Winlogon runs Userinit.exe, which is an application used to run a program before a shell starts. The service runs logon scripts, reestablishes network connections and starts the shell.
The default value is C:\WINDOWS\SYSTEM32\Userinit.exe, (note the comma at the end).This value could be hacked by malware to read:
HijackThis will tag the contents of this key even if only the comma is missing and it's OK to have it fixed though it's harmless.
Example of entries from HijackThis logs
Recommendation:
Do not use HijackThis to fix these entries without expert guidance. If you fix the wrong entry, your computer may not be bootable without some serious trobleshooting. This is especially true for F2 entries as the restore function of HijackThis for this particular section has some potentially serious issues.
N1 entry in a HijackThis log refers to the homepage URL settings in Netscape 4.x browser in the prefs.js file located in the users Netscape directory.
Example of N1 entries from HijackThis logs
N2 - Netscape 6x default homepage and search page URLs
N2 entry in a HijackThis log refers to homepage and searchpage URLs of Netscape 6 browser in the prefs.js file located in the 'Application Data' folder.
Example of N2 entries from HijackThis logs
N3 - Netscape 7x default homepage and search page URLs
N3 entry in a HijackThis log refers to homepage and searchpage URLs of Netscape 7 browser in the pref.js file located in the 'Application Data' folder.
Example of N3 entries from HijackThis logs
N4 - Mozilla default homepage and search page URLs
N4 entry in a HijackThis log refers to homepage and searchpage URLs of Mozilla browser in the prefs.js file located in the 'Application Data' folder.
I have not seen the N4 entries in any of the HijackThis logs.
Recommendation:
The N entries are similar to the R0 and R1 entries which refers to the IE browser. Again the key is the URL shown in the respective entries. If you don't recognize the URL or there are no URL's at the end of the entry, it can be safely fixed with HijackThis. It's very unlikely that Netscape or Mozilla browsers to get hijacked unless you download and install a malware installer unknowingly. An example would be LOP.com hijack. This comes in the form of an executable installer which may masquerade as 'mp3_finder.exe, download_file.exe, free_warez exe or free_sex_viewer.exe among others. These installers change your preferred home and search page URL's in Netscape and Mozilla browsers. It also adds a task to run on startup which sets your homepage and search back to lop if you change them.
The hosts file maps host names to IP addresses.
The short answer is that the Hosts file is like an address book. When you type an address like
Please login or register to download
or
Use full direct 100Mbit downloader
into your browser, the Hosts file is consulted to see if you have the IP address, or "telephone number," for that site. If you do, then your computer will "call it" and the site will open. If not, your computer will ask your ISP's (internet service provider) computer for the phone number before it can "call" that site. Most of the time, you do not have addresses in your "address book," because you have not put any there. Therefore, most of the time your computer asks for the IP address from your ISP to find sites.
What is a hosts file?
Please login or register to download
or
Use full direct 100Mbit downloader
Hosts file can also be hijacked by malware, by changing the DNS entries in your hosts file, effectively making windows believe a web site has a different IP than it really has and thus making IE open the wrong page. A benign hostname such as cnn.com could be made to point to a malicious website. HijackThis can detect the re-direction entries.
Example of 01 malicious entries from HijackThis logs
Here the hijack will redirect the address on the right to the IP address to the left.
i.e,
In the first entry of the example, if you type
Please login or register to download
or
Use full direct 100Mbit downloader
in your browser you will be taken to the malicious website 64.191.95.139 instead of google.com. Many variants of CWS (Cool Web Search) parasite uses this method to hijack IE.
You may find one another entry in HijackThis logs pertaining to hosts file redirection. It may look like this;
Here the HijackThis tags the redirection to the hosts file itself perperated by some parasites. The legitimate hosts file is located in the following locations in various flavours of windows;
Recommendation:
You can always have HijackThis fix these, unless you knowingly put those entries in your Hosts file.
O2 - Browser Helper Objects
In this section, HijackThis tags all the "Browser Helper Objects" that is being used by your IE, whether good or bad. A browser helper object, or BHO, is a component that Internet Explorer loads whenever it starts or if you have Active Desktop turned on, even when you open a file folder on your own computer and can perform many actions on available windows. BHOs can be either good or bad, but most of them contain spyware in one form or another.Sometimes these BHOs just sneak onto your computer and you don't even realize they are there! Some of them can be downright malicious!
Some common examples of BHOs are Aureate/Radiate, Alexa, Flyswat, Gator, GetRight, Gozilla, RealDownload, and Yahoo Companion
Example of 02 entries from HijackThis logs.
Recommendation:
Need to be careful in selecting entries in this section for fixing with HijackThis as it lists both benign (google toolbar, acrobat reader and Spybot S & Ds download protection etc) and malicious BHOs. There is a very comprehensive regularly updatedated at the CastleCops.com,The CLSID/BHO List/Toolbar Master List
Please login or register to download
or
Use full direct 100Mbit downloader
where it is possible to search by the CLSID's (the alpha-numeric charecters in between the curly brackets). Choose to fix an entry only if you are absolutely sure otherwise consult an expert as deletion of certain BHOs will affect the smooth functioning of IE.
O3 - Internet Explorer toolbars
A toolbar for Internet Explorer is nomally located below the menu bar at the top of the form. IE Toolbars are created by Browser Helper Objects. Many toolbars available on the Internet are spyware. They can be annoying or even outright malicious by tracking your online behaviour and displaying popup ads.
Example of 03 entries from HijackThis logs
Recommendation:
As Hijackthis lists all the 3rd party toolbars good and bad, discretion is required when selecting entries to fix. Again the exhaustive list at CastleCops The CLSID/BHO List/Toolbar Master List
Please login or register to download
or
Use full direct 100Mbit downloader
may be used to search for the offending CLSID's, if you don't directly recognize a toolbar's name.
O4 - Autoloading programs from Registry & Startup group
As the title indicates, this section of HijackThis logs lists all programs that autolaod from the registry and startup group. Autoloading entries can load a registry script, VBScript or Javascript file possibly causing the IE start page, search page, search bar or search assistant to revert back to a hijackers page after a system reboot. Also, a DLL file can be loaded that will hook into several parts of your system.
Example of 04 entries from HijackThis logs
Recommendation:
An amazing number of Windows applications, from freeware and shareware utilities to full-blown commercial suites such as Microsoft Office, manage to insert some portion of themselves into your Windows Startup. There are some you should never turn off, though. Definitely leave entries such as ScanRegistry and SystemTray well alone, as these are critical parts of Windows itself and are best left alone. How do you identify malware or unnecessary programs loading at startup? If you don't recognize the program from its name or if you are plainly suspicious of an entry, use CastleCops - StartupList, a searchable, comprehensive list of the programs you may find that run when you switch on your PC as typically identified by MSCONFIG or the registry "Run" keys - and whether you need them.
Please login or register to download
or
Use full direct 100Mbit downloader
O5 - IE Options icon not visible in Control Panel
In this section HijackThis checks for the "Internet options" applet available in the control panel. Each item in Control Panel has an associated ".cpl" file. These files, along with the Control Panel initialization file, "Control.ini", are loaded into memory when Control Panel is opened. A hijacker may modify the control.ini to prevent access to the "Internet Options" window, thereby preventing the user from resetting various hijacked options.
Example of 05 entries from HijackThis logs
This entry is not commonly seen in HijackThis logs.
Recommendation:
Unless you or an administrator has chosen to hide the 'Internet options' applet from the control panel by modifying the control.ini file, it's safe to have HijackThis fix this entry.
This section is similar to 05 section in the sense that HijackThis tags the disabling of the "Internet options" applet in the windows control panel and the restriction on changing the startpage setting. The difference here is HijackThis checks the registry key "HKCU\Software\Policies\Microsoft\Internet Explorer\" for any restrictions placed by using administrative policies. HijackThis lists this even if the option in Spybot S&D is used to protect the startpage from being changed by malware.
In this section, Hijackthis lists different types of entries,
Example of 06 entries from HijackThis logs
Restrictions present: You or an administrator has set a policy which disables changing IE start page for the current user.
Control Panel present: You or an administrator has set a policy which restricts access to the 'Internet options' from within the IE or in the control panel.
Toolbars\Restrictions present: You or an administrator has set a policy which restricts access to the IE toolbar.
This setting is also used by malware to restrict the user from changing the hijacked start page, search page etc,. and generally to restrict the user from accessing the "Internet options" applet in the control panel.
Recommendation:
Unless you or an administrator has applied this policy in your system for the users, it is safe to have HijackThis fix these entries.
O7 - Regedit access restricted by Administrator
Once again this setting is applied through administrative policies. Disabling the ability to use the registry editor is normally used by administrators to restrict their users, it can also be used by malware to prevent access the registry settings. HijackThis checks the registry key
Example of 07 entries from HijackThis logs
Recommendation:
Unless you or an administrator has applied this policy in your system for the users, it is safe to have HijackThis fix this entry.
08 - Extra items in IE right-click menu
In this section HijackThis lists the extra items -i.e. not those default items like back, forward etc,.- only the items installed by 3rd party software, both legitimate and otherwise. HijackThis checks the registry keys
and lists all the extra items. These extra context menu items can prove helpful or annoying. Some hijackers are known to add to the context menu.
Example of 08 entries from HijackThis logs
Recommendation:
If you don't recognize the name of the item or if you don't use an item in the right-click menu in IE, it can be safely fixed with HijackThis.
O9 - Extra buttons on main IE button toolbar, or extra items in IE 'Tools' menu
In this section HijackThis tags the extra buttons on main IE tool bar and extra items in the 'Tools' menu of IE. HijackThis checks the registry keys
and lists all the extra buttons and extra items on the "Tools" menu of IE.
These can be researched at CastleCops - O9 List of Extra IE Buttons list.
Please login or register to download
or
Use alternative full direct 100Mbit download
Example of 09 entries from HijackThis logs
Recommendation:
If you don't recognize the name of the item or if you don't use an item in the right-click menu in IE, it can be safely fixed with HijackThis.
O10 - Winsock hijacker
Winsock is short for Windows Sockets API. It describes a standard way for Windows programs to work with TCP/IP. You use WinSock or the more recent Winsock2 if you directly connect your Windows PC to the Internet. Winsock incorporates a feature called Layered Service Provider (LSP), which allows legitimate third-party software like anti-virus, firewall and other security related software vendors to insert their own code into the "chain". It has access to every data entering and leaving the computer.
This feature is mis-used by a few hijackers to facilitate their own monitoring. Data packets outward bound from your computer to a legitimate destination on the web can be intercepted by a malware LSP and sent somewhere else, other than where you had intended it to go. As Merijn says "Only a very small selection of spyware used this method of infection as it requires hooking into the Winsock LSP chain, which lies very deep into the bowels of Windows and is one of the hardest parts of Windows to manipulate." Some examples are New.net, Webhancer, CommonName and a CWS variant CWS.Msspi do this.
Example 010 entries from HijackThis logs
Recommendation:
Do not fix 010 entries or use programs like LSPfix or WinsockFix yourself without any expert/helper advising you to do so. Fixing the LSP stack is not advised unless you are sure of what you are doing and know how to undo as a wrong fix will screw up your internet connection and in some cases only a repair install or a reinstall will get you back. A lot of legitimate programs use the LSP to perform their tasks, HijackThis has only a part of them in its ignored (safe) list, so many false positives are imminent. Please note that merijn also says that "unknown' files in the LSP stack will not be fixed by HijackThis, for safety issues."
If you want to have a look at the LSPs in your system, use Spybot S&D
Please login or register to download
or
Use alternative full direct 100Mbit download
or download the free LSP explorer add-on
Please login or register to download
or
Use alternative full direct 100Mbit download
for Ad-Aware SE.
Please login or register to download
or
Use alternative full direct 100Mbit download
Spybot-S&D is able to display a list of installed network drivers and allows this list to be exported for future reference. In version 1.3 entries that have changed since the last snapshot are displayed in bold letters.This allows you to see changes to the list at once. Ad-Aware SE LSP explorer goes a step further by letting you backup and restore the LSPs. It also lets you view active LSP and Name Service Providers on your system, along with detailed information about each so you can determine whether or not they're legitimate.
LSP's can be researched at CastleCop's LSP List.
Please login or register to download
or
Use alternative full direct 100Mbit download
In this section HijackThis tags the addition of an extra group in the "Advanced" tab of Internet options in IE. The options in the "Advanced" tab of IE options are stored in the registry and extra options can be added easily by creating extra registry keys. Very rarely malware add their own options there, E.g,. CommonName adds a group with a few options. Some legitimate programs also add their group there.
Example of 011 entries from HijackThis logs.
Recommendation:
If the listed program name is 'CommonName', have HijackThis fix this. If you don't recognize the name, take an expert's opinion before fixing this entry.
O12 - IE plugins
Plugins are small programs that add particular functions to an existing larger programs like IE, typically used to display or play some multimedia content found on a web document. For example, QuickTime movies, Flash and Shockwave animations. When spyware or hijackers add plugins for their filetypes, the danger exists that they get reinstalled if everything but the plugin has been removed, and the browser opens such a file.
Example of 012 entries from HijackThis logs
HijackThis lists all the plugins installed on your machine. There seems to be only one pest that use this method at present, it is Onflow media player, a graphics provider and ad-tracking and reporting company for Web advertisers. It appears in the HijackThis logs with an extension ".ofb".
Recommendation:
All most all of the entries appearing in this section are harmless. Don't fix anything otherthan onflow.
O13 - IE DefaultPrefix hijack
When a website URL like
Please login or register to download
or
Use alternative download link
is typed into IE's address bar without the prefix, http:// in this case, it is automatically added when you hit Enter. This prefix, together with the default prefixes for FTP, Gopher and a few other protocols are stored in the registry keys
A hijacker change these values to the URL of his server, as a result the victims, always get redirected to the hijacker's website when they forget to type the prefix. Many variants of CWS parasite uses this method.
Example of 013 entries from HijackThis logs
Recommendation:
You need not be selective here. Whatever changes the default prefix of various protocols cannot be good. Have HijackThis fix all instances of this.
O14 - 'Reset Web Settings' hijack
In this section HijackThis checks the file "iereset.inf" for changes which might indicate a hijack. When you click on "Reset Web settings" on the Programs tab of Internet options, IE restores the default values for home page, search page and a few other items from the registry files stored in "iereset.int" file. This file is located in inf folder in your system folder. Some OEM's create their own custom URL's for this file.
Malware changes the default URL's to its own, so that when you click "Reset web settings" you get re-infected rather than cured.
Example of 014 entries from HijackThis logs
Recommendation:
If the URL is not the provider of your computer or your ISP, have HijackThis fix it.
O15 - Unwanted site in Trusted Zone
In this section HijackThis lists the sites in the "Trusted Zone" - originally meant for content located on Web sites that are considered more reputable or trustworthy than other sites on the Internet - of Internet explorer. Web sites in the Trusted Zone (Internet options Security Trusted Zone Sites) are allowed to use normally dangerous scripts and ActiveX objects other sites are not allowed to use as the default security level is low. Some malware programs will automatically add a site to the Trusted Zone without you knowing.
Example of 015 entries from HijackThis logs
Recommendation:
Some variants of CWS parasite are known to add sites to the Trusted Zone. If you didn't add the listed domain to the Trusted Zone yourself, have HijackThis fix it.
In this section HijackThis tags the items found in "Downloaded Program Files" folder in the Windows folder. This folder holds various types of files downloaded from the internet including ActiveX and Java objects. The legitimate purpose of ActiveX objects is to allow website creators to embed small programs in their sites which will interact with your browser to provide an enhanced experience to the visitor. Because of its nature, ActiveX makes a very good platform for installing spyware, adware, dialers, and hijackers.
Example of 016 entries from HijackThis logs
Recommendation:
If you don't recognize the name of the object, or the URL it was downloaded from, it is safe to have HijackThis fix it. If you are unsure about an item get an expert opinion about fixing it. Even if you have choosen to fix a legitimate ActiveX object, you will be prompted to download it when you use that particular service from the website concerned. Please note that fixing those ActiveX objects required for sites using secure logins will cause problems when you try to login to that site again, So be careful what you choose to fix with HijackThis.
O17 - Lop.com domain hijackers
In this section HijackThis checks various keys in registry hive HKEY LOCAL MACHINE for specific values which help windows to resolve domain names into IP addresses. Hijacking these values can cause the programs which use the internet to be redirected to other malicious sites. Some versions of Lop.com use this method, together with huge list of cryptic domains.
Example of 017 entries from HijackThis logs
Recommendation:
It's best to leave the O17s alone unless they clearly point to a bad site. Removing a needed 017 entry may break your internet connectivity as they may be used by your ISP or your company network.
O18 - Extra protocols and protocol hijackers
This section of HijackThis looks for new or changed protocols used by Windows to 'talk' to programs, servers or itself. A protocol is one IE interprets as the beginning of an address like http://, https://, ftp://, gopher:// etc,. LOP.com uses this method to make IE load content using an "ayb:// whatever address" similarly CommonName uses cn://. Several legitimate programs also do this.
Example of 018 entries from HijackThis logs
Recommendation:
Only a few hijackers show up here. The known baddies are 'cn' (CommonName), 'ayb' (Lop.com) and 'relatedlinks' (Huntbar), you should have HijackThis fix those. Other things that show up are either not confirmed safe yet, or are hijacked. If you are in doubt get an expert opinion before fixing it.
The 018 items can be researched at CastleCops - O18 Extra protocols and protocol hijackers list.
Please login or register to download
or
Direct Download at 100Mbit
O19 - User style sheet hijack
IE has an option to use a user-defined stylesheet for all pages instead of the default one, to enable visually challenged users to better view the web pages. Many CWS parasites overwrite any stylesheet the user has setup and replaces it with one that causes popup, as well as system slowdown.
Example of 019 entries from HijackThis logs.
Recommendation:
At present as only CWS does this, it is recommended to use CWShredder to fix it unless you have setup a stylesheet for your use.
O20 - AppInit_DLLs Registry value autorun
AppInit_DLLs value is documented in MS Knowledge Base article, Working with the AppInit_DLLs registry value.
Please login or register to download
or
Direct Download at 100Mbit
The AppInit_DLLs value is found in the following registry key:
All the DLLs that are specified in this value are loaded by each Microsoft Windows-based application that is running in the current log on session.
What the above means is that any DLL listed in the AppInit_DLLs value will run concurrently with every program launched, even in Safemode.
Example of 020 entries from HijackThis logs
Recommendation:
The 020 entries can be researched at CastleCops - O20 AppInit_DLLs and Winlogon Notify list.
Please login or register to download
or
Direct Download at 100Mbit
Very few legitimate programs use this autostart method, some variants of CWS infection are known to use this method to load a hidden dll at Windows startup. You should get an expert's opinion before deciding to fix (delete) these entries.
This is an undocumented autorun method, executed by "Explorer.exe" as soon as it has loaded. Each value under the following registry key contains information to the DLL name and location. The system will load the referred DLLs and link them to "Explorer.exe"
Example of 021 entries from HijackThis logs
Recommendation:
HijackThis tags only those entries that are not in its internal whitelist, but not all entries tagged by HijackThis are bad. The 021 items can be researched at CastleCops - O21 ShellServiceObjectDelayLoad list.
Please login or register to download
or
Download here directly at 100Mbit
Please obtain expert/helper help before fixing (deleting) these entries.
O22 - SharedTaskScheduler
This undocumented autorun method applies only to Windows XP, Windows 2000 and NT. Here HijackThis tags the registry key
Example of 022 entry from HijackThis logs
Recommendation:
This is a rare entry appearing in the HijackThis logs. The 023 items can be researched at CastleCops - O22 SharedTaskScheduler list
Please login or register to download
or
Download here directly at 100Mbit
Please obtain opinion from helper/expert before fixing (deleting) this entry.
O23 - NT Services
Please login or register to download
or
Download here directly at 100Mbit
HijackThis checks the registry key
for non-Microsoft services.
Note that not all entries tagged by HijackThis are bad.
Examples of 023 entries in HijackThis logs
Recommendation:
The 023 items can be researched at CastleCops - O23 List of Windows XP/NT services.
Please login or register to download
or
Download here directly at 100Mbit
Please obtain help from helper/expert before fixing (deleting) these entries.