THOR Troubleshooting Skill

Goal: diagnose the failure mode fast and propose minimal next actions.

Rules

• Assume AV/EDR interference until disproven (especially "frozen at 98%" style reports).
• For scan aborts: check last ~50 log lines first. Clear message = THOR's decision (Rescontrol/timeout). No message = external kill.
• Ask for exactly the minimum needed: platform + THOR version + command used + what "stuck" means (no progress? no output? stopped early?).
• Use Ctrl+C interrupt menu guidance when relevant.
• Prefer thor-util diagnostics when available.

Use these references when needed

• Stuck scans: reference/stuck-scans.md
• Scan aborts (Rescontrol, timeouts, AV/EDR kills): reference/scan-aborts.md
• AV/EDR interference patterns: reference/av-edr-interference.md
• Diagnostics: reference/diagnostics.md
• Performance and memory issues: reference/performance-and-resources.md
• Common pitfalls (fast empty scans, wrong paths): reference/common-pitfalls.md

Optional helper script

• scripts/quick-env-check.sh: quick info dump about folder permissions, free space, CPU/RAM, and THOR files present.

Output format

• Likely cause ranking (top 3)
• Next command(s) to run
• What evidence to collect (files/log snippets) if it persists