Question

Locked

Random Junk Printing all over the network!

By Deming Schools Network ·
Okay, I'm part of a team that manages a network for a public school district. Starting last Friday afternoon, we began to see random printers on the network printing junk by the hundreds of pages. The only thing that stopped the job was the printer running out of paper.

Looking at printer logs, these jobs have no originator, date or time info. The only identifing piece of info (on the ones directly plugged in to the network) is they are printed from Port 9100. There are also several printers that are shared which are having the same issue.

We've been all over the Internet and found little information - other than the fact that this can happen. We need some help figuring out how to stop the printing! Disabling Port 9100 on the network printers does stop the attack, but there is no such option on the older printers that have been shared. The issue does not seem to discriminate as it has hit Dell, HP Inkjet, HP Laser, and Xerox Laser printers, both old and new. These devices are also in multiple sites/subnets.

Oh yeah.... the only readable text in the printouts is the first line which states "this program does not run in MS DOS.."

This conversation is currently closed to new comments.

18 total posts (Page 1 of 2)   01 | 02   Next
| Thread display: Collapse - | Expand +

All Answers

Collapse -

Sounds like it's printing the contents of an executable file

by seanferd In reply to Random Junk Printing all ...

Could be a student doing a little hacking, or possibly some bit of malware that got into your network.

I would be checking in whatever network logs there are to see where the job was initiated. Perhaps a tool like Wireshark or Angry IP scanner may be of use, as well as simply using tcpdump (while such an incident is occurring.) Right now, I think you're stuck with network logs.

Perhaps those with more network experience could shine a light on this for you. Good luck.

Collapse -

Don't share printers on PC's

by smallbiz-techwiz In reply to Random Junk Printing all ...

I'm not a big fan of sharing printers on desktop PC's. It's either open to everyone, or not at all. There's no way to effectively control access to it in this scenario. I think it's better to share only network printers that are controlled by a server. The server can then require authentication from users that want to use it's shared resources. You also have lots of flexibility with permissions and scheduling.

Collapse -

That would be great!

I'm not a big fan of many of the ways we end up dealing with things in Public School Districts due to lack of funding or lack of setting priorities that include the importance of technology. Unforntuately, we have to make due with many old printers (some of those that have this issue do not have network cards) that must be shared just to provide printing capabilities that are needed. Funds for print servers and such things are few and far between.

Thus, we end up dealing with these sorts of issues instead of planning for future improvements!

Collapse -

I've seen this

by Kenone In reply to Random Junk Printing all ...

A few things can cause it. Best guess would be someone trying to print from within a program (with its own printer drivers) and just randomly pointing at printers. Keep alert to "I can't print" complaints.
On shared printers, especially old ones, you should be able to configure the port as an LPR. That reduces this behaviour.

Collapse -

Sounds malicious to me...

by -Q-240248 In reply to Random Junk Printing all ...

Probably someone who is infected with something. Try shutting down the machines and cleaning them, see if you cna narrow down the affected machine.

Collapse -

That is my suspicion...

by Deming Schools Network In reply to Sounds malicious to me...

Definately malicious. We have done quite a bit of checking for malicious code and such so far, but we have over 3000 computers in the district and only 3 technicians. Shutting them down really won't work. (Well, it may work for me - but not for teachers, staff and students). :0)

Collapse -

printer virus'

by shasca In reply to That is my suspicion...

Few years back I had heard of a printer virus that caused this type of weirdness. See if the link below is any help.

http://www.infoworld.com/articles/op/xml/00/04/10/000410oplivingston.html

Collapse -

We found something!

There is something here, we found a worm... W32/Mariofev.worm. Seems, this worm deposits a file "marioforever.exe" in shared folders, and if it runs, causes these random print jobs. This virus exploits file and print sharing in windows operating systems.

We have not found any utility to actually stop this from happening. Malwarebytes will see it, and remove it, but will not protect it from being re-infected. Anyone dealt with this one before?

Collapse -

What Antivirus are you running

by Jacky Howe In reply to Random Junk Printing all ...

have you updated the definitions for it. In other words is it up to date.

Collapse -

Vexira

We are running Vexira and yup, everything appears to be up to date. I have found more information on the virus, but still not clear removal/protection against re-infection information. This one started in May, 2008 and there is more info here...

http://en.securitylab.ru/viruses/352672.php

Back to Networks Forum
18 total posts (Page 1 of 2)   01 | 02   Next

Hardware Forums