Tech: 'Status' - ghost program driving me nuts

Subject: RE: Tech: 'Status' - ghost program driving me nuts
From: JohnInKansas
Date: 31 Oct 13 - 12:47 PM

Leenia - If you don't suspect that your computer is infected by CryptoLocker, why do you care about that information?

Bleepingcomputer and others like it will give you very specific instructions, step by step, for exactly what you must do to create a "document" that tells them what's on your computer and what your computer is doing with it. You post that document. (You don't have to understand it, if you follow the instructions.)

One of their analysts will look at what you post, and will reply with specific instructions for what you need to do to get things fixed. (You don't really have to understand what the instructions do, if you can follow their list carefully and do all of the steps they tell you to do.)

The "technical skills" you need in order to ask for their help are less complicated than what you need to read a cookbook to figure out why your cake came out lopsided.

The only "technical skill" you need is the ability to describe your machine, operating system, and symptoms accurately (and completely) enough to get one of their analysts interested in your problem.

Of course, it's really fun to learn something, so browsing there to see other people's problems can be rewarding; but you do that a little at a time if you're interested in becoming a nerd.

John

Subject: RE: Tech: 'Status' - ghost program driving me nuts
From: GUEST,leeneia
Date: 31 Oct 13 - 12:07 PM

I took a look at bleepingcomputer.com. Here's a sample:

"A DNS sinkhole campaign is underway and in high gear to block computers infected with CryptoLocker from reaching the malware's Command & Control servers. A DNS sinkhole is a method used by security researchers to monitor Botnets and to block communication between an infected computer and its Command & Control server."

If that's supposed to be for the unskilled computer user, then I'm in big trouble.

Subject: RE: Tech: 'Status' - ghost program driving me nuts
From: JohnInKansas
Date: 31 Oct 13 - 11:43 AM

One reason for a notice of that kind used to be fairly common, although I haven't seen mention of it recently.

Earlier malware/Antivirus programs were fairly good at deleting or disabling the malware program files, but sometimes a piece of malware would write a line into the Registry to open a file it used, or sometimes to reinstall the malware if a file got deleted. The Registry entry wasn't, technically, malware but was just an ordinary instruction to the computer. Those old AV programs weren't as good at cleaning up Registry entries made by the malware before the file got zapped as they were at zapping the files.

If your AV "quarantines" files rather than just deleting them, it may keep a list of files in quarantine that you can look at to see if the the "missing" ones is there. If it is, you might have one of the rare instances of the above ancient peculiarity.

If the file was deleted, but the registry wasn't cleaned out, the computer would keep asking for the file, wouldn't find it, and would, quite appropriately, inform you that a file was missing. Removing a Registry entry of this kind usually requires manual editing of the Registry, and unless you're familiar with that process it is likely you should get detailed instructions. Bleepingcomputer.com is a well known and usually reliable advisor, if you can follow their instructions carefully.

It's also possible, of course, that a file that's supposed to be on the computer isn't there, or has been "corrupted." The proliferation of multipurpose "printers" has resulted in a need to check "status" fairly often since the printer manufacturers assume that you need their toy to do almost anything. Sometimes re-initializing your printer, by turning it off for several seconds and then turning it back on and letting it run it's "get ready" routine will recreate it's file(s). For some devices you may need to disconnect the power cord for a couple of minutes to let it "lose" internal memory that's retained in the device when it's just "off" in order to get a full recovery.

It's also possible that the installation/attachment of a multipurpose device failed, and reinstalling the "printer" control program may be needed. Recent PCs are pretty good at finding a printer setup, or you may have a disk that came with a device. Sometimes it makes a difference which you use (?).

All of this is pretty much just guesswork, of course.

John

Subject: RE: Tech: 'Status' - ghost program driving me nuts
From: bobad
Date: 31 Oct 13 - 10:07 AM

Do a disc cleanup which should get rid of the "Temp" file. If it keeps coming back look for the source that is creating it by using a tool such as "Process Monitor".

Subject: RE: Tech: 'Status' - ghost program driving me nuts
From: Stilly River Sage
Date: 31 Oct 13 - 09:23 AM

Having a place that gives you a chance to research and discuss oddball little programs, malware, and software is useful. I joined Bleepingcomputer.com a number of years ago. They ask that you join the group (it's free) and that you search the site first before asking a question. They answer questions for people but don't want to keep answering the same questions for people who don't do a diligent search before posting a question.

SRS

Subject: RE: 'Status' - ghost program driving me nuts
From: GUEST,rewind
Date: 31 Oct 13 - 09:05 AM

sorry, meant to put this in Tech

Subject: 'Status' - ghost program driving me nuts
From: GUEST,rewind
Date: 31 Oct 13 - 09:05 AM

My new PC has started throwing up a series of small windows saying it's looking for a program called Status. It does this for any new activity eg printing.
I've no idea where that came from and I can't find any reference to it when I search.

Any ideas on getting rid of this pest?

This is the info in the box:

C:\Users\AppData\Local\Temp\7zS7C2F\setup\status\