[Bethzania]

My PC started slowing down two weeks ago when I went into Page Setup in Excel. (Three to five min to get it to pop up.) This week, while shutting down, I received a little dialog box saying "Thor Conn Wnd Class". I have run the newest Ad-Aware SE, Spybot 1.3, and although they found lots of cookies and a couple files they didn't find anything called THOR. I ran them both in Safe Mode, and also a AV scan to no avail. Can you please help?
Thank you so much in advance!
Bethany

1 year old Optiplex
OS Win XP
Office 2003 Basic

Here is my HIJACKTHIS log:
Logfile of HijackThis v1.98.2
Scan saved at 10:12:40 AM, on 10/28/2004
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
C:\Program Files\Dell\OpenManage\Client\Iap.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
C:\Program Files\Intel\ASF Agent\ASFAgent.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\vptray.exe
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
C:\Documents and Settings\Ron.VPS_COMPANIES\My Documents\tempbethany\Hijack\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://rd.companion.yahoo.com/slv/ycheck/as/*http://
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://rd.companion.yahoo.com/slv/yc.../www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell.com
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://rd.companion.yahoo.com/slv/yc...om/search?p=%s
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\WINDOWS\Downloaded Program Files\ycomp5_1_3_0.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\WINDOWS\Downloaded Program Files\ycomp5_1_3_0.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [vptray] C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\vptray.exe
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {EF99BD32-C1FB-11D2-892F-0090271D4F88} (Yahoo! Companion) - http://us.dl1.yimg.com/download.yaho...bio5_1_3_0.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = vps-companies
O17 - HKLM\Software\..\Telephony: DomainName = vps-companies
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = vps-companies
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = vps-companies

[bps725]

I had this some time back and it was not easy to get rid of. The problem is in you outlook and its a old virus back from windows 98. I had to first backup my files in outlook and then delete everything in it. Then I had to import everything back in. Look around for Thor Conn Wnd + Outlook. It took me a while to find help

[nl2]

Originally Posted by bps725

I had this some time back and it was not easy to get rid of. The problem is in you outlook and its a old virus back from windows 98. I had to first backup my files in outlook and then delete everything in it. Then I had to import everything back in. Look around for Thor Conn Wnd + Outlook. It took me a while to find help

Do you have more information for me. I also have this problem and i can't find any hint in the web at any search engine. Some more details or virus-scanner which can handle this virus in Outlook. Would it be enought to reinstall outlook?

What is this virus doing?

[bps725]

This worked for me... But I have a question.. Do you do any remote email checking or sync with another computer or pda? Well here is a fix you can try.

Damaged Personal Folders
If you suspect a damaged Personal Folders file, follow these steps to remove the Personal Folders from your profile and to create a new Personal Folders file: 1. In Control Panel, click to open the Mail And Fax icon. If you did not install fax services, you may have only a Mail icon.
2. Under the Services tab, click to select your profile, and then click Properties.
3. Click to select Personal Folders, and then click Remove.
4. Click Add, and in the "Available information services" box, click Personal Folders and OK to open the "Create/Open Personal Folders File" dialog box.
5. In the File Name box, type a new personal store (*.pst) file name, and then click Open to open your new Personal Folders properties dialog box.
6. Under the General tab, click OK to return to the Profile Properties dialog box.
7. Click OK and Close to close all dialog boxes

I have also just changed the name of my Personal folder and created a new one. The backed up from the original. Hope this helps

[bps725]

Make SURE to backup you PST first before you delete it. You will need it to restore your old information

[bps725]

It is not a virus like some people say. It is a sync problem between your computer and the mail server. Your PST file has differant information because of a lost or incomplete email and causes the ThorConnWin file to continue to look for a file that is not there.

[annesco]

I'm having the same problem, and this right after a complete reinstall of my OS. I didn't have the problem before, though. Any other thoughts?