I've been mystified about this for a few days, ever since I came here. I heard there's a "list" to check normal vs abnormal, but off-the-bat, peculiar stuff, what does one look for?

If you do a net search for hijackthis tutorials, you'll find several (such as this one -- http://www.bleepingcomputer.com/forums/index.php?showtutorial=42)

Using the tutorials and a lot of net searching is the best way to analyze hijackthis logs.

There is no list of 'normal vs abnormal.' If you look around this forum you'll find many examples of clean logs, that are all different, and infected logs, which are all different as well.

And, since there are new threats coming out daily, I doubt if any such 'list' could ever be created and kept current.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.