ThorConnWndClass is getting serious
October 9, 2012 12:50 AM Subscribe
ThorConnWndClass is getting serious. Anybody have a solution?
Using Office 2007 on an XP Pro SP3 box, I've been getting this problem more and more frequently, now up to almost regularly every day. Outlook email client hangs with a mesage like "Downloading (or sometimes Sending) x messages, y kb" or similar, and the only way out is to shut down (the whole PC, not just Outlook) and reboot. On shutting down, I get a window telling me ThorConnWndClass is still running and inviting me to terminate it.
I've asked the question on a usually very helpful Windows forum I frequent, but no solution was found. On another excellent Windows forum it hasn't ever been discussed. I've googled it and found a hundred threads by fellow-sufferers, but none of them had a solution. Some (not all) mentioned a connection with Norton, but I've never, ever had anything from Norton installed. The string "ThorConnWndClass" is not found in the registry.
Apart from the nuisance of having to reboot, I'm getting worried about all these phantom messages being sent or received: is my PC a zombie taken over by a botnet?
Using Office 2007 on an XP Pro SP3 box, I've been getting this problem more and more frequently, now up to almost regularly every day. Outlook email client hangs with a mesage like "Downloading (or sometimes Sending) x messages, y kb" or similar, and the only way out is to shut down (the whole PC, not just Outlook) and reboot. On shutting down, I get a window telling me ThorConnWndClass is still running and inviting me to terminate it.
I've asked the question on a usually very helpful Windows forum I frequent, but no solution was found. On another excellent Windows forum it hasn't ever been discussed. I've googled it and found a hundred threads by fellow-sufferers, but none of them had a solution. Some (not all) mentioned a connection with Norton, but I've never, ever had anything from Norton installed. The string "ThorConnWndClass" is not found in the registry.
Apart from the nuisance of having to reboot, I'm getting worried about all these phantom messages being sent or received: is my PC a zombie taken over by a botnet?
Response by poster: Many thanks, Chairboy. In fact although I hadn't seen that specific thread, I'd already found pretty much all of those suggestions in various other threads and tried them. The one thing I saw there I hadn't tried was downloading all my email using my ISP's webmail and deleting it once read, which I'm now about to do. But since the ThorConnWndClass issue crops up with no obvious trigger, it's not going to be easy to see if it's been solved - just waiting to see whether it happens again.
I'll report back if there's any progress (or none).
posted by aqsakal at 6:18 AM on October 9, 2012
I'll report back if there's any progress (or none).
posted by aqsakal at 6:18 AM on October 9, 2012
Response by poster: Thanks, luke - yes. Keyword not found.
posted by aqsakal at 8:47 AM on October 9, 2012
posted by aqsakal at 8:47 AM on October 9, 2012
Best answer: This is an interesting problem . (Have the human Microsoft MVPs been replaced by close to useless FAQ url posting scripts?). Also Superuser.com is the better stackexchange site for end user problems - stack overflow is for developer questions but it still comes up with nothing for this problem.
It seems that outlook is spawning a separate process called ThorConnWndClass. The name suggests a class inheritance hierarchy involving a connection object of some sort that isn't closing properly when you try to exit suggesting that is still busy trying to do whatever the connection is for - likely downloading or sending mail.
Pretty sloppy programming to expose your class names and to not catch errors but that's Microsoft Outlook for you.
But yeah, it is probably something to do with what you are trying to download or upload to your mail server either being corrupt, too big or too much and the problem either isn't handled well by the process or takes so long you think it isn't working.
posted by srboisvert at 11:09 AM on October 9, 2012
It seems that outlook is spawning a separate process called ThorConnWndClass. The name suggests a class inheritance hierarchy involving a connection object of some sort that isn't closing properly when you try to exit suggesting that is still busy trying to do whatever the connection is for - likely downloading or sending mail.
Pretty sloppy programming to expose your class names and to not catch errors but that's Microsoft Outlook for you.
But yeah, it is probably something to do with what you are trying to download or upload to your mail server either being corrupt, too big or too much and the problem either isn't handled well by the process or takes so long you think it isn't working.
posted by srboisvert at 11:09 AM on October 9, 2012
Best answer: Have you tried wiping/re-installing Office? I would start here instead of using the built in uninstaller. I would also completely remove your mail profiles from the control panel/mail prior to uninstalling.
And just to confirm, you've already tried:
regsvr32.exe inetcomm.dll
Since that error and this command go hand-in-hand in a lot of threads, I would suspect that ThorConnWndClass possibly exists inside inetcomm.dll or is chained through it. I would search your computer for instances of inetcomm.dll and take note if the versions are different in all areas returned. Rename all of them to inetcomm.bak except for the one in c:\windows\system32\. If that doesn't seem to help, try swapping it out with one that reported a newer version if one already exists on the PC. Under no circumstances however would you want to download one from a random website, try get the file directly from Microsoft if you'd like to try replacing it.
Another option, if you feel fairly comfortable with how a PC operates, would be to download and run Process Monitor. You'll want to pay special attention to what's going on when the lockups occur. Right-click and exclude processes from the filter that are irrelevant to help narrow it down.
Also, since Norton is mentioned, it's possible that any Anti-virus could be causing the issue. Try temporarily removing your anti-virus solution/security suite just for testing purposes. You'll want to make sure as little processes are running as possible while you're working on this issue. If it is your AV solution, Microsoft Security Essentials could possibly fill the gap (if it's not already MSE)
posted by samsara at 11:28 AM on October 9, 2012
And just to confirm, you've already tried:
regsvr32.exe inetcomm.dll
Since that error and this command go hand-in-hand in a lot of threads, I would suspect that ThorConnWndClass possibly exists inside inetcomm.dll or is chained through it. I would search your computer for instances of inetcomm.dll and take note if the versions are different in all areas returned. Rename all of them to inetcomm.bak except for the one in c:\windows\system32\. If that doesn't seem to help, try swapping it out with one that reported a newer version if one already exists on the PC. Under no circumstances however would you want to download one from a random website, try get the file directly from Microsoft if you'd like to try replacing it.
Another option, if you feel fairly comfortable with how a PC operates, would be to download and run Process Monitor. You'll want to pay special attention to what's going on when the lockups occur. Right-click and exclude processes from the filter that are irrelevant to help narrow it down.
Also, since Norton is mentioned, it's possible that any Anti-virus could be causing the issue. Try temporarily removing your anti-virus solution/security suite just for testing purposes. You'll want to make sure as little processes are running as possible while you're working on this issue. If it is your AV solution, Microsoft Security Essentials could possibly fill the gap (if it's not already MSE)
posted by samsara at 11:28 AM on October 9, 2012
(just in case it's helpful, a good way to search for inetcomm.dll would be to type cd \ and then dir /s/a/b inetcomm.dll > "%userprofile%\desktop\dirresults.txt" in a command prompt. That will create a text file of them on your desktop...just ignore any that exist in c:\windows\winsxs\ if any)
posted by samsara at 11:39 AM on October 9, 2012
posted by samsara at 11:39 AM on October 9, 2012
Response by poster: Many thanks indeed! A lot of that was over my head in technical terms, but as soon as I can free up half a day I'll print off srbousvert's and samsara's very helpful posts and work through them in sequence. I'll report back here if there are any useful results. Part of the problem, of course, is that it's a negative I'm looking for, like a solution when TCWC doesn't raise its ugly head for a long time (whatever "a long time" is).
For any others with the problem and following this thread: MSE is my only AV at the moment, and yes, I already found and tried the regsvr32.exe inetcomm.dll tip.
posted by aqsakal at 12:42 AM on October 10, 2012
For any others with the problem and following this thread: MSE is my only AV at the moment, and yes, I already found and tried the regsvr32.exe inetcomm.dll tip.
posted by aqsakal at 12:42 AM on October 10, 2012
Response by poster: And I'm not marking "best answers" for the moment, as that is supposed to apply to posts which resolve a problem. But I'm still grateful for the time and effort put into the advice you've given.
posted by aqsakal at 12:45 AM on October 10, 2012
posted by aqsakal at 12:45 AM on October 10, 2012
You might be able to get additional information on the error out of the event viewer too.
posted by samsara at 5:39 AM on October 10, 2012
posted by samsara at 5:39 AM on October 10, 2012
Response by poster: OK, I found 33 instances of inetcomm.dll on the PC (including a second, old HD I keep just for any old stuff there may be on it, so not actually active), of which 11 on the current C: drive, and these came in 7 different flavours from v. 60.2900.2180 to -6157. The one in \system32 is the most recent (-6157), so I kept it and renamed the other 10 to inetcomm.bak.
Now I sit back and wait until a couple of days have gone by to see whether TCWC crops up again.
posted by aqsakal at 4:15 AM on October 11, 2012
Now I sit back and wait until a couple of days have gone by to see whether TCWC crops up again.
posted by aqsakal at 4:15 AM on October 11, 2012
Response by poster: Superstition forbids me to state that this problem has gone away, but [whisper] it hasn't raised it's ugly head for a couple of days now [/whisper], which is a heck of an improvement. So I'm tentatively marking two "best answers" above and thanks again to all helpers for detailed input.
posted by aqsakal at 8:50 AM on October 14, 2012
posted by aqsakal at 8:50 AM on October 14, 2012
Good to hear! *knocks on desk* You might want to examine your %path% variable to see if any of those inetcomm.dll's were in a path preceding c:\windows\system32\
At a command prompt:
echo %path%
You normally want c:\windows\system32 and c:\windows as your first two search paths. To re-arrange these or trim out uneeded paths, you can modify the path variable under your advanced system settings/advanced/environment variables. (right-click on computer and select properties). Each path is separated with a semi-colon.
It's also possible the working directory for Outlook was defaulting to one that had an out of date inetcomm.dll. An easy way to check would be to run the Process Monitor linked above after renaming all the .baks back to .dlls (or if you saw one in an office folder, you could try renaming it back to .dll to see if the problem returns)
Although, no sense attempting to fix more what seems to be no longer broken ;)
posted by samsara at 6:57 AM on October 15, 2012
At a command prompt:
echo %path%
You normally want c:\windows\system32 and c:\windows as your first two search paths. To re-arrange these or trim out uneeded paths, you can modify the path variable under your advanced system settings/advanced/environment variables. (right-click on computer and select properties). Each path is separated with a semi-colon.
It's also possible the working directory for Outlook was defaulting to one that had an out of date inetcomm.dll. An easy way to check would be to run the Process Monitor linked above after renaming all the .baks back to .dlls (or if you saw one in an office folder, you could try renaming it back to .dll to see if the problem returns)
Although, no sense attempting to fix more what seems to be no longer broken ;)
posted by samsara at 6:57 AM on October 15, 2012
Response by poster: No, as you rightly say, if it ain't broke, don't fix it. (I'm certainly not going to play around with anything as long as it stays working well like this.) But checking and rearranging the %path% seems to be a good idea anyway, and I'll do that this evening. Many thanks again for following up.
posted by aqsakal at 8:23 AM on October 16, 2012
posted by aqsakal at 8:23 AM on October 16, 2012
Response by poster: Two weeks later, and it seems to be solved. Many thanks to all for input and advice.
posted by aqsakal at 3:50 AM on November 1, 2012 [1 favorite]
posted by aqsakal at 3:50 AM on November 1, 2012 [1 favorite]
Mod note: Final update from the OP:
The suggestions above didn't totally kill the bug, but reduced it to only very rare occurences. Then in another forum I came across the tip to use scanpst.exe to repair the Outlook mailbox. It found several issues to correct, and the problem [fingers crossed] hasn't occurred since.posted by taz (staff) at 4:06 AM on November 26, 2016 [1 favorite]
This thread is closed to new comments.
posted by Chairboy at 5:36 AM on October 9, 2012