An operating system provides a shell which runs applications and provides access to the hardware. The operating system also provides services, for doing things like reading and writing files, accessing the internet, and so forth.
In Windows, the shell is Explorer.exe. Explorer.exe can have child Explorers, but when you run windows you are running the underlying first Explorer.exe. If you end it in Task Manager, Windows will replace it (or give you the Blue Screen of Death).
How does Explorer get started when you turn on your PC?
The BIOS's first instruction automatically runs at power on. The BIOS then initializes the memory, the hard drives, and the other hardware. After initialization and self-tests are done, it reads the boot record which was installed when the disk was partitioned. It finds the loader address from the boot record, and writes the loader from the disk into memory. The BIOS does a few checks to see if it looks valid, and then jumps into it in memory. The loader, which is part of the installation of the operating system, has the code to do some more initialization and eventually get the services and the Explorer shell going.
Following it well so far, cnm….
One part of the beauty of Merijin’s great program is that it allows for an interested but non technical helper to become proficient in log reading, without having an expert level understanding of an OS. Being good at the HjT process is a fine thing; being able to answer confidently about an OS related question that comes up is obviously a far better result.
If I am reading the aim of this section of the classroom correctly, to understand how HjT functions, you will need a good working knowledge of an OS. Having never done any kind of course, I find my knowledge is reasonable at best, but fragmented in what I’ve picked up along the way. Using Hjt has initiated a serious interest in understanding the OS a lot better.
I’m hoping that this section will relate many of the queries that come through, back to an HjT category, and broaden the depth of understanding for everyone. …oO [has anyone ever documented this process explanation before? if so>where? where?] <_< (apart from the tutorials..)
So something general to start with…….
For its purposes, HjT categorises an OS into ~ 19 major sections of operations (+running processes added to the log),
From booting up, are these categories in a fairly accurate chronological sequence from F0 onwards ?
Whereabouts in this process do the .ini files kick in……
The "Shell=Explorer.exe" is in the system.ini file, right?….
hmmm….…time to shoosh………I’ll let you continue…….
So something general to start with…….
For its purposes, HjT categorises an OS into ~ 19 major sections of operations (+running processes added to the log),
That would be a way of looking at it, but I've always thought of HijackThis log as a list of registry keys (although it does include other things).
I'll try and start a "What is the registry?" - or maybe someone else will?
So something general to start with…….
For its purposes, HjT categorises an OS into ~ 19 major sections of operations (+running processes added to the log),
In my thinking of this, it is more of a categorization of possible areas of problems, there are infinatly more considerations to a computer being able to run than just those 19 things but it does help considerably to control those 19 areas currently
The OS also keeps track of all the running processes on the computer. Where a computer is running many tasks at once (called multitasking, and is usually the case) it will keep tabs on each and every one.
It decides what share of processor power each task gets, based on its priority.
As there is only one CPU, the computer can only actually perform one task at a time; each task is scheduled in and out. Because this happens so very quickly, we as human beings are given the impression that the computer really is handling some 32 tasks all at the same time.
There are two main methods of doing this: either it can schedule from one to the next in a chain, and restart when it gets to the end, or otherwise it can work by tasks interrupting others and getting attention by the use of interrupts. Some systems will use a mixture of both, with the higher priority tasks making more use of interrupts.
When a fault (bug, security loophole, etc) is found, a patch would be raised to cure it. Essentially this knocks out the duff code and replaces it with the new code. In the case of Windows, very often a new module is released by Microsoft.
In the case of Windows, after a number of patches have been raised for one particular program (such as Internet Explorer), they would bundle all the patches together into a single download and call it a "service pack".
A hijacker would work either by resetting a user's default settings (easy to fix - just revert the settings) or by inserting a new task into the task chain that keeps on resetting the settings to the ones desired by the hijacker. This is why it is necessary when fixing some hijacks to kill a process, reboot into safe mode, delete the offending module, and remove it from the startup list. Otherwise, every time that task gets its look-in, it will check your settings and re-hijack them. Tools such as HijackThis, AdAware, Spybot Search and Destroy, and CWShredder no doubt work by targeting the offending processes in this manner.
Even nastier is where a hijacker actually replaces a legitimate file (such as a DLL) with its own version, which essentially forms a patch to the OS. Instead of knocking out bad code and replacing it with fixed code, it will put a hook in to a call to something nefarious which effects the hijack.
From booting up, are these categories in a fairly accurate chronological sequence from F0 onwards ?
No, not at all. The order in which Windows loads different startups (look at a StartupList log to see even more than HijackThis shows) is obscure, but I know that for example the shell scandisk command in Win2000/XP comes very early, and the files in the Startup group of the Start Menu come last. It's pretty hard to figure out what's is actually executed when, since this is also dependant on the systems speed, memory, startup lag time etc.
There is also a pretty good Operating System Introduction at the link below:
Operating Systems Introduction
I haven't gone through the entire site but through skimming the site it looks pretty good.
It does indeed look pretty good! Thanks for that link.
They also provide self-study courses in the following, at no charge provided that you recognize their copyright:
QUOTE
Self Study Guides Currently Available
8051 Microcontrollers
80x86 Assembler
C Programming
Data Communications
Data Structures
Embedded Systems
Excel 2000
Hardware Introduction - I
Hardware Introduction - II
Internet: An introduction
Internet Management
MS-DOS
Networks: An Introduction
Operating Systems
Pascal Programming
PowerPoint 2000
Research: An Introduction
Windows 2000 Server
Windows 3.1
Windows 95 Windows NT Server v4.0
Word 2000
WWW/HTML/Multi-media Unix
Visual Basic 6.0
Thanks sage,
This is exactlythetyp of stuff I can really use to prime myself so that I can ustilize HJT better and more proficantly. now I have two areas to learn in. I think that this will be a good site for a lot of beginners to go to so that they may learn a little easier.
Another nice part is it will help us a little better understanding of what certain things do so that us helpers don't accidently screw up someones machine.
Ed
This is some really good informaion. I've been involved here for just a week, and finding these postings to be most valuable. Having been an IT professional for many years, but only programming for some of that, we all know its far too easy to rely on some tools for our fixes with out having a better fundamental understanding of the underlying systems. There are no cookie cutter answers, silver bullets or magik spells. I have often pushed the edge of my knowledge were I know just enough to be extremely dangerous, though I am far more conservative on other's systems. While it may appear daunting, expand your OS, Registry, etc learning as much as possible.
-Rakes
One part of the beauty of Merijin’s great program is that it allows for an interested but non technical helper to become proficient in log reading, without having an expert level understanding of an OS. Being good at the HjT process is a fine thing; being able to answer confidently about an OS related question that comes up is obviously a far better result.
If I am reading the aim of this section of the classroom correctly, to understand how HjT functions, you will need a good working knowledge of an OS. Having never done any kind of course, I find my knowledge is reasonable at best, but fragmented in what I’ve picked up along the way. Using Hjt has initiated a serious interest in understanding the OS a lot better. 
I’m hoping that this section will relate many of the queries that come through, back to an HjT category, and broaden the depth of understanding for everyone. …oO [has anyone ever documented this process explanation before? if so>where? where?] <_< 
(apart from the tutorials..)
So something general to start with…….
For its purposes, HjT categorises an OS into ~ 19 major sections of operations (+running processes added to the log),
From booting up, are these categories in a fairly accurate chronological sequence from F0 onwards ?
Whereabouts in this process do the .ini files kick in……
The "Shell=Explorer.exe" is in the system.ini file, right?….
hmmm….…time to shoosh………I’ll let you continue…….
Hello Everyone!
I've noticed a lot of registry items in HJT Logs so thought I would drop a few useful links to help people understand a little more about it. I'm by no means an expert but I'm learning. 
much appreciated
Stefanus
I have often pushed the edge of my knowledge were I know just enough to be extremely dangerous,