HijackDat v1.99.1 — HijackThis Parody Browser Hijacker Scanner

HijackDat is a parody of HijackThis — the beloved free Windows security tool created by Dutch programmer Merijn Bellekom, widely used from approximately 2003 to 2007. HijackThis scanned a Windows system for browser hijackers, adware, and spyware by inspecting registry keys, Browser Helper Objects (BHOs), startup entries, Winsock LSP providers, running NT services, and protocol handlers. It presented results as a log file of categorized entries — R0 and R1 for browser start and search page hijacks, O2 for Browser Helper Objects, O4 for startup registry entries, O10 for Winsock/LSP hijackers, O17 for DNS name server changes, O18 for protocol hijacks, and O23 for NT services — which users would copy and post on security forums like SpywareInfo, Bleeping Computer, or DSL Reports, where experts would advise which items to fix. HijackThis was later acquired by Trend Micro. Version 1.99.1 was one of the most widely distributed builds.

HijackDat simulates a period-accurate scan of Doors 98's parody C:\\ drive. The 7-second animated scan traverses C:\\Doors\\System\\ and C:\\Program Files\\ and reveals 18 log entries spanning all major HijackThis categories: R0 and R1 entries show the browser start page hijacked to muricaweb.net; R3 shows a missing URLSearchHook; O2 entries flag YourWay Search Assistant and NeatWebFind Toolbar as Browser Helper Objects; O4 entries show six programs autolaunching at startup — ChumChimp, Snoozer, BassJamb, MuricaOnline, and StarPointer; O10 flags a DoorSock hijack by WhileU (DoorSock being Doors 98's equivalent of Winsock, after the parody OS name); O17 shows a suspicious NameServer entry; O18 flags the muricaweb protocol handler; and O23 exposes three NT services — Download More RAM Helper, WhileU Scheduler, and StarPointer Cursor Driver.

Parody threat roster: ChumChimp (parody of BonziBuddy) is a purple gorilla desktop assistant that installs NeatWebFind toolbar and resets the homepage to muricaweb.net. Snoozer (parody of Kazaa) is a P2P file sharing client seeding 4 files to 1,337 peers with 2,847 shared files indexed. YourWay Search Assistant (parody of MyWay Search) hijacked the browser search bar across 847 browsing sessions. NeatWebFind Toolbar (parody of CoolWebSearch) is an aggressive browser hijacker with a DLL in C:\\Doors\\System\\. MuricaOnline (parody of AOL) autolaunches mol.exe at startup — dialing in at 56,000 baud with 9,847 hours remaining. BassJamb (parody of Winamp) is the era-standard MP3 player found in virtually every HijackThis log of the period. StarPointer (parody of Comet Cursor) replaces the cursor with a shooting star and registers both an autorun executable and a kernel driver starpnt.sys. WhileU (parody of WhenU SaveNow) hijacks the DoorSock LSP layer with whileu.dll and runs a background scheduler. Download More RAM Helper (dlmore.exe) is a parody of the classic internet joke — registering as a legitimate NT service that reports downloading 0 additional megabytes of RAM.

Fix Checked triggers 49 sequential confirmation dialog boxes that cannot be dismissed — you must click OK through all of them. They escalate from earnest system warnings through guilt-tripping ("ChumChimp will be very lonely"), existential observations ("Are you even still reading these?"), corporate defeat ("Fine.", "FINE.", "We just want you to know we are very disappointed."), and finally a last-gasp deal pitch from WhileU before bottoming out at "fine" and "Reboot required to complete removal." Clicking OK on the final dialog triggers a full-screen blue screen of death — Doors 98 fatal exception 0E at 0028:C0034B53 — that holds for five seconds before resetting to idle. Save Log downloads a correctly formatted hijackdat.log including running process list, all log entries, and a byte count footer. Analyze This attempts to contact merijn.org for online log analysis and cannot connect.

All parody paths referenced in the log are real entries in the Doors 98 command-line filesystem. C:\\Doors\\System\\ contains starpnt.exe, starpnt.sys, whileu.dll, dlmore.exe, nwfsrch.dll, and the core Doors system executables. C:\\Program Files\\ contains subdirectories for ChumChimp, Snoozer, MuricaOnline, BassJamb, WhileU, and YourWay — all navigable from the command line. Running chimpassist.exe, snoozer.exe, mol.exe, dlmore.exe, or starpnt.exe from the command line produces era-appropriate fake output.