Na verdade,
THUNDER.DLL verificou-se para realizar o seguinte comportamento:
* The Process is packed and/or encrypted using a software packing process
* The Process is polymorphic and can change its structure
* Creation and Registration of a Browser Helper Object in Internet Explorer
* Enables an In Process Object/Server - Common with DLL Injections
* Registers a Dynamic Link Libray (DLL) File
* Registers a Dynamic Link Library File
* Found on infected systems and resists interrogation by security products
Assim, você deve usar algumas ferramentas de remoção . Também acho que o AVG pode remover isto.