Windows uses records in the 'hosts' file to look-up domain names before querying internet DNS servers.

O1 - Hijack of Hosts and hosts.ics files / DNSApi hijacking O23 - Windows Services and Drivers, Dependencies.O21 - Shell Service Object Delay Load (SSODL), Shell Icon Overlay (SIOI), ShellExecuteHooks (SEH).O17 - Domain and DNS hijack / DNS issued by router through DHCP.O16 - Downloaded Program Files items (DPF).O15 - Internet Explorer: Web-sites and protocols in 'Trusted Zone'.O14 - Internet Explorer: Changing of IERESET.INF.O13 - Internet Explorer: Hijacking of URL prefixes.O12 - Internet Explorer: plugins for file extensions or MIME types.O11 - Internet Explorer: options in 'Advanced' settings tab.O10 - Breaking of Internet access due to the damage or infection in Winsock LSP.O9 - Internet Explorer: Extra services and buttons.O8 - Internet Explorer: Extra context menu items.

O7 - Policies: Regedit, Explorer, TaskMgr / IP Security / Certificates / OS troubleshooting.

O6 - IE Policy: Disabling of 'Internet Options' main tab.

O4 - Autoloading Registry entries and 'Autostart' folder / msconfig disabled items.

O1 - Hijack of Hosts and hosts.ics files / DNSApi hijacking.

F3 - Created registry parameter that is override ini-file settings (load, run).

F2 - Changed registry value that is override ini-file settings (shell, userinit).

F1 - Created ini-file parameter (win.ini).

F0 - Changed ini-file value (system.ini).

R3 - Created extra registry parameter where only one should beį - Autoloading from INI-files and corresponding registry locations.

R - Changes in basic Internet Explorer settings: The different sections of hijacking influences have been separated into the following groups:

Download hijackthis 2021