Does anybody know of a virus or trojan that populates the infected machine with multiple hidden windows with the titles 'Hammer of Thor' and 'THOR MAIN WINDOW'? I have a machine with these symptoms running WinXP. The windows can only be seen using Spy (from the MS Platform SDK) or a similiar tool. What really concerns me is that these windows seem to receive window messages when internet related apps such as IE are in use. At all other times they remain silent. Any info much appreciated!!!

Greetings, I've got the "Hamemr of Thor" / "Thor Main Window" invisble hiding window problem too :^( I first experienced this when shutting down and seeing "Thor Main W..." was waiting to close ... hmmm. Then I did a quick search online that it turns out only a page or two was everything I could find on this problem! How can it be that only a few people in the whole google have this!? FWIW I found out that it is something only related to one login (user) on my machine -- all 6 other users didn't have it! (I even tried creating a new user to see if Thor would migrate to the new user, but it didnt). I thought of a Browser Helper Object but all the same BHOs are loaded for all users... The one thing I found extra was Sentinal reported the class is "Mjolnir" (the name of Thor's hammer). I also tried turning off EVERYTHING in my startup and STILL Thor Main Window lurks... I'd appreciate any new insights you've found! B^)

Ding Dong The Witch Is Dead Hi! I have such excellent news I got an email from a kindred soul that had the answer: MS Office Alternative User Input. http://support.microsoft.com:80/support/kb/articles/Q282/5/99.ASP&NoWebContent=1&NoWebContent=1 I followed the directions and it worked like a champ. a little more info here too: http://support.microsoft.com/?kbid=326526 Good Luck to all who stumble upon the Hammer of Thor! B^)

This also drove me crazy for a bit Basically it's part of the Office Xp/2000 alternate use inputs so if you loaded speech or handwriting recognition options, it's there. Thor's Hammer is made by triCerat Software and is part of the Windows Terminal Server and Citrix MetaFrame systems. It is associated with and loaded with Ctfmon.exe from Citrix Systems, Inc Ctfmon.exe monitors the active windows and provides text input service support for speech recognition, handwriting recognition, keyboard, translation, and other alternative user input technologies. Thor's Hammer is the code that stores all elements in a self-replicating database called desktop2001 code named "Thor’s Hammer." For example, if a virus attempts to run an executable it will fail. In addition, programs that users download from the Internet or receive by e-mail will fail unless they have explicit permission. So it's actually not a bad thing. However if you want to remove it see here [url]http://support.microsoft.com/default.aspx?scid=http://support.microsoft.com:80/support/kb/articles/Q282/5/99.ASP&NoWebContent=1&NoWebContent=1&NoWebContent=1[/url] For info on the software developer [url]http://www.tricerat.com/[/url] Cheers Robb "Mave" Mavins