HijackThis Log Codes Definitions

Trend Micro HijackThis is a free utility that generates an in-depth report of registry and file settings from your computer. After running a scan, HijackThis diplays log files with alphanumeric codes for diagnosis.

HijackThis LogBut...do you know what those codes mean?

The information below will help you decide on what to change during cleaning up of infected computers. The alphanumeric codes for the current version, Trend Micro HijackThis v2.0.2, have their corresponding definitions, as follows:

R - Registry, StartPage/SearchPage changes
  • R0 - Changed registry value
  • R1 - Created registry value
  • R2 - Created registry key
  • R3 - Created extra registry value where only one should be
F - IniFiles, autoloading entries
  • F0 - Changed inifile value
  • F1 - Created inifile value
  • F2 - Changed inifile value, mapped to Registry
  • F3 - Created inifile value, mapped to Registry
N - Netscape/Mozilla StartPage/SearchPage changes
  • N1 - Change in prefs.js of Netscape 4.x
  • N2 - Change in prefs.js of Netscape 6
  • N3 - Change in prefs.js of Netscape 7
  • N4 - Change in prefs.js of Mozilla
O - Other, several sections which represent:
  • O1 - Hijack of auto.search.msn.com with Hosts file
  • O2 - Enumeration of existing MSIE BHO's
  • O3 - Enumeration of existing MSIE toolbars
  • O4 - Enumeration of suspicious autoloading Registry entries
  • O5 - Blocking of loading Internet Options in Control Panel
  • O6 - Disabling of 'Internet Options' Main tab with Policies
  • O7 - Disabling of Regedit with Policies
  • O8 - Extra MSIE context menu items
  • O9 - Extra 'Tools' menuitems and buttons
  • O10 - Breaking of Internet access by New.Net or WebHancer
  • O11 - Extra options in MSIE 'Advanced' settings tab
  • O12 - MSIE plugins for file extensions or MIME types
  • O13 - Hijack of default URL prefixes
  • O14 - Changing of IERESET.INF
  • O15 - Trusted Zone Autoadd
  • O16 - Download Program Files item
  • O17 - Domain hijack
  • O18 - Enumeration of existing protocols and filters
  • O19 - User stylesheet hijack
  • O20 - AppInit_DLLs autorun Registry value, Winlogon Notify Registry keys
  • O21 - ShellServiceObjectDelayLoad (SSODL) autorun Registry key
  • O22 - SharedTaskScheduler autorun Registry key
  • O23 - Enumeration of NT Services
  • O24 - Enumeration of ActiveX Desktop Components
The information provided above can be also be seen if you access the HijackThis interface. Just open HijackThis > Other stuff > Info... > Help.

If you have not tried this software yet, download it and then install. Run a system scan and protect your PC from malware infection.

I hope you find this post useful.