THOR Troubleshooting Skill

Goal: diagnose the failure mode fast and propose minimal next actions.

Rules

• •Assume AV/EDR interference until disproven (especially "frozen at 98%" style reports).
• •For scan aborts: check last ~50 log lines first. Clear message = THOR's decision (Rescontrol/timeout). No message = external kill.
• •Ask for exactly the minimum needed: platform + THOR version + command used + what "stuck" means (no progress? no output? stopped early?).
• •Use Ctrl+C interrupt menu guidance when relevant.
• •Prefer thor-util diagnostics when available.

Use these references when needed

• •Stuck scans: reference/stuck-scans.md
• •Scan aborts (Rescontrol, timeouts, AV/EDR kills): reference/scan-aborts.md
• •AV/EDR interference patterns: reference/av-edr-interference.md
• •Diagnostics: reference/diagnostics.md
• •Performance and memory issues: reference/performance-and-resources.md
• •Common pitfalls (fast empty scans, wrong paths): reference/common-pitfalls.md

Optional helper script

• •scripts/quick-env-check.sh: quick info dump about folder permissions, free space, CPU/RAM, and THOR files present.

Output format

• •Likely cause ranking (top 3)
• •Next command(s) to run
• •What evidence to collect (files/log snippets) if it persists