1. Computer problem? Tech Support Guy is completely free -- paid for by advertisers and donations. Click here to join today! If you're new to Tech Support Guy, we highly recommend that you visit our Guide for New Members.

Thor Conn Wnd Class Hijack!

Discussion in 'Windows XP' started by Bethzania, Oct 28, 2004.

Thread Status:
Not open for further replies.
  1. Bethzania

    Bethzania Thread Starter

    Dec 15, 2003
    My PC started slowing down two weeks ago when I went into Page Setup in Excel. (Three to five min to get it to pop up.) This week, while shutting down, I received a little dialog box saying "Thor Conn Wnd Class". I have run the newest Ad-Aware SE, Spybot 1.3, and although they found lots of cookies and a couple files they didn't find anything called THOR. I ran them both in Safe Mode, and also a AV scan to no avail. Can you please help?
    Thank you so much in advance!

    1 year old Optiplex
    OS Win XP
    Office 2003 Basic

    Here is my HIJACKTHIS log:
    Logfile of HijackThis v1.98.2
    Scan saved at 10:12:40 AM, on 10/28/2004
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\Program Files\Dell\OpenManage\Client\Iap.exe
    C:\Program Files\Intel\ASF Agent\ASFAgent.exe
    C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\vptray.exe
    C:\Program Files\Logitech\iTouch\iTouch.exe
    C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
    C:\Documents and Settings\Ron.VPS_COMPANIES\My Documents\tempbethany\Hijack\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.com
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://rd.companion.yahoo.com/slv/ycheck/as/*http://
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://rd.companion.yahoo.com/slv/ycheck/as/*http://www.yahoo.com
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.com
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell.com
    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://rd.companion.yahoo.com/slv/ycheck/as/*http://search.yahoo.com/search?p=%s
    O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\WINDOWS\Downloaded Program Files\ycomp5_1_3_0.dll
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
    O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\WINDOWS\Downloaded Program Files\ycomp5_1_3_0.dll
    O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
    O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
    O4 - HKLM\..\Run: [vptray] C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\vptray.exe
    O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
    O16 - DPF: {EF99BD32-C1FB-11D2-892F-0090271D4F88} (Yahoo! Companion) - http://us.dl1.yimg.com/download.yahoo.com/dl/toolbar/yiebio5_1_3_0.cab
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = vps-companies
    O17 - HKLM\Software\..\Telephony: DomainName = vps-companies
    O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = vps-companies
    O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = vps-companies
  2. bps725


    Nov 8, 2004
    I had this some time back and it was not easy to get rid of. The problem is in you outlook and its a old virus back from windows 98. I had to first backup my files in outlook and then delete everything in it. Then I had to import everything back in. Look around for Thor Conn Wnd + Outlook. It took me a while to find help
  3. nl2


    Jun 30, 2005
    Do you have more information for me. I also have this problem and i can't find any hint in the web at any search engine. Some more details or virus-scanner which can handle this virus in Outlook. Would it be enought to reinstall outlook?

    What is this virus doing?
  4. bps725


    Nov 8, 2004
    This worked for me... But I have a question.. Do you do any remote email checking or sync with another computer or pda? Well here is a fix you can try.

    Damaged Personal Folders
    If you suspect a damaged Personal Folders file, follow these steps to remove the Personal Folders from your profile and to create a new Personal Folders file: 1. In Control Panel, click to open the Mail And Fax icon. If you did not install fax services, you may have only a Mail icon.
    2. Under the Services tab, click to select your profile, and then click Properties.
    3. Click to select Personal Folders, and then click Remove.
    4. Click Add, and in the "Available information services" box, click Personal Folders and OK to open the "Create/Open Personal Folders File" dialog box.
    5. In the File Name box, type a new personal store (*.pst) file name, and then click Open to open your new Personal Folders properties dialog box.
    6. Under the General tab, click OK to return to the Profile Properties dialog box.
    7. Click OK and Close to close all dialog boxes

    I have also just changed the name of my Personal folder and created a new one. The backed up from the original. Hope this helps
  5. bps725


    Nov 8, 2004
    Make SURE to backup you PST first before you delete it. You will need it to restore your old information
  6. bps725


    Nov 8, 2004
    It is not a virus like some people say. It is a sync problem between your computer and the mail server. Your PST file has differant information because of a lost or incomplete email and causes the ThorConnWin file to continue to look for a file that is not there.
  7. annesco


    Dec 13, 2005
    I'm having the same problem, and this right after a complete reinstall of my OS. I didn't have the problem before, though. Any other thoughts?
As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 733,556 other people just like you!

Thread Status:
Not open for further replies.

Short URL to this thread: https://techguy.org/289843