Advertisement

There's no such thing as a stupid question, but they're the easiest to answer.
Login
Search

Advertisement

Windows XP Windows XP
Search Search
Search for:
Tech Support Guy > > >

Thor Conn Wnd Class Hijack!


(!)

Bethzania's Avatar
Bethzania Bethzania is offline
Junior Member with 12 posts.
THREAD STARTER
 
Join Date: Dec 2003
Experience: AS/400 focus
28-Oct-2004, 12:41 PM #1
Unhappy Thor Conn Wnd Class Hijack!
My PC started slowing down two weeks ago when I went into Page Setup in Excel. (Three to five min to get it to pop up.) This week, while shutting down, I received a little dialog box saying "Thor Conn Wnd Class". I have run the newest Ad-Aware SE, Spybot 1.3, and although they found lots of cookies and a couple files they didn't find anything called THOR. I ran them both in Safe Mode, and also a AV scan to no avail. Can you please help?
Thank you so much in advance!
Bethany

1 year old Optiplex
OS Win XP
Office 2003 Basic

Here is my HIJACKTHIS log:
Logfile of HijackThis v1.98.2
Scan saved at 10:12:40 AM, on 10/28/2004
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
C:\Program Files\Dell\OpenManage\Client\Iap.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
C:\Program Files\Intel\ASF Agent\ASFAgent.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\vptray.exe
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
C:\Documents and Settings\Ron.VPS_COMPANIES\My Documents\tempbethany\Hijack\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://rd.companion.yahoo.com/slv/ycheck/as/*http://
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://rd.companion.yahoo.com/slv/yc.../www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell.com
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://rd.companion.yahoo.com/slv/yc...om/search?p=%s
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\WINDOWS\Downloaded Program Files\ycomp5_1_3_0.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\WINDOWS\Downloaded Program Files\ycomp5_1_3_0.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [vptray] C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\vptray.exe
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {EF99BD32-C1FB-11D2-892F-0090271D4F88} (Yahoo! Companion) - http://us.dl1.yimg.com/download.yaho...bio5_1_3_0.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = vps-companies
O17 - HKLM\Software\..\Telephony: DomainName = vps-companies
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = vps-companies
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = vps-companies
bps725's Avatar
bps725 bps725 is offline
Junior Member with 4 posts.
 
Join Date: Nov 2004
08-Nov-2004, 11:37 PM #2
Okay this is a dooozzzy
I had this some time back and it was not easy to get rid of. The problem is in you outlook and its a old virus back from windows 98. I had to first backup my files in outlook and then delete everything in it. Then I had to import everything back in. Look around for Thor Conn Wnd + Outlook. It took me a while to find help
nl2's Avatar
nl2 nl2 is offline
Junior Member with 1 posts.
 
Join Date: Jun 2005
30-Jun-2005, 05:41 AM #3
Quote:
Originally Posted by bps725
I had this some time back and it was not easy to get rid of. The problem is in you outlook and its a old virus back from windows 98. I had to first backup my files in outlook and then delete everything in it. Then I had to import everything back in. Look around for Thor Conn Wnd + Outlook. It took me a while to find help
Do you have more information for me. I also have this problem and i can't find any hint in the web at any search engine. Some more details or virus-scanner which can handle this virus in Outlook. Would it be enought to reinstall outlook?

What is this virus doing?
bps725's Avatar
bps725 bps725 is offline
Junior Member with 4 posts.
 
Join Date: Nov 2004
04-Jul-2005, 11:29 PM #4
This worked
This worked for me... But I have a question.. Do you do any remote email checking or sync with another computer or pda? Well here is a fix you can try.

Damaged Personal Folders
If you suspect a damaged Personal Folders file, follow these steps to remove the Personal Folders from your profile and to create a new Personal Folders file: 1. In Control Panel, click to open the Mail And Fax icon. If you did not install fax services, you may have only a Mail icon.
2. Under the Services tab, click to select your profile, and then click Properties.
3. Click to select Personal Folders, and then click Remove.
4. Click Add, and in the "Available information services" box, click Personal Folders and OK to open the "Create/Open Personal Folders File" dialog box.
5. In the File Name box, type a new personal store (*.pst) file name, and then click Open to open your new Personal Folders properties dialog box.
6. Under the General tab, click OK to return to the Profile Properties dialog box.
7. Click OK and Close to close all dialog boxes

I have also just changed the name of my Personal folder and created a new one. The backed up from the original. Hope this helps
bps725's Avatar
bps725 bps725 is offline
Junior Member with 4 posts.
 
Join Date: Nov 2004
04-Jul-2005, 11:31 PM #5
Make SURE to backup you PST first before you delete it. You will need it to restore your old information
bps725's Avatar
bps725 bps725 is offline
Junior Member with 4 posts.
 
Join Date: Nov 2004
04-Jul-2005, 11:34 PM #6
It is not a virus like some people say. It is a sync problem between your computer and the mail server. Your PST file has differant information because of a lost or incomplete email and causes the ThorConnWin file to continue to look for a file that is not there.
annesco's Avatar
annesco annesco is offline
Junior Member with 1 posts.
 
Join Date: Dec 2005
13-Dec-2005, 02:46 PM #7
Help
I'm having the same problem, and this right after a complete reinstall of my OS. I didn't have the problem before, though. Any other thoughts?
As Seen On

BBC, Reader's Digest, PC Magazine, Today Show, Money Magazine
WELCOME TO TECH SUPPORT GUY!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.


(clock)
THIS THREAD HAS EXPIRED.
Are you having the same problem? We have volunteers ready to answer your question, but first you'll have to join for free. Need help getting started? Check out our Welcome Guide.

Search Tech Support Guy

Find the solution to your
computer problem!




Currently Active Users Viewing This Thread: 1 (0 members and 1 guests)
 
Thread Tools


WELCOME
You Are Using: Server ID
Trusted Website Back to the Top ↑

Content Relevant URLs by vBSEO 3.3.2