Printing virus

[Bealy]

I think we may have a printing virus. Every printer in our organisation are spitting out garble. Is there any news of a virus that is going around doing this?

 

[AVChap]

Ahm, bad printer cables? Or probably wrong drivers?

If it were a virus, it's not much. It won't spread, since printer outputs do not infect other printers

Most logical answer here is a joke program running.

AVChap

 

[yizhar]

HI.

Many print servers will log each print job, so it is a good idea to try tracing the source computer(s?) there.

Bye
Yizhar Hurwitz

http://come.to/yizhar

http://teachers.sivan.co.il/yizhar

 

[menny10]

Hi, Bealy,


Be sure of you printer configuration, may be some drivers are lost, always keep a copy of the files you use to setup a printer, re-install the correct drivers, check for good cables, and trace the print job in each computer.

 

[2ffat]

There is a rumor going around that the Bugbear virus will do this. I have not been able to confirm it, though.
James P. Cottingham

When a man sits with a pretty girl for an hour, it seems like a minute. But let him sit on a hot stove for a minute and it's longer than any hour. That's relativity.
[tab][tab]Albert Einstein explaining his Theory of Relativity to a group of journalists.

 

[iSeriesCodePoet]

I got this message yesterday on the subject from a AS400 mailing list (note the AS400 is not affected by this directly).

------------------------
Just got a mail from a friend of mine that his company was hit as well.

------------------------
<ign_list@ignite400.org> (IGNITe/400 Mailing List) wrote:

There's a nasty new virus that appeared yesterday and drove us crazy, one of it's symptons is to make all printers start to print strange characters.

We are just starting to receive several infected messages, for further information please read:

http://vil.nai.com/vil/content/v_99728.htm

PS: Yesterday our box simply crashed, we had to perform a manual IPL and found no traces of any problems, don't know if it was coincidental or not. Mike Wills
IBM iSeries (AS/400) Programmer

http://www.koldark.net

 

[Luckyfour]

No doubt you've seen (probably everywhere) that is it the W32.Bugbear@mm. &quot;Security Response has seen that because the worm does not properly handle the network resource types, it may flood shared printer resources, which causes them to print garbage or disrupt their normal functionality.&quot; (Symantec) It's been a long time since I've seen a &quot;4&quot; rated virus on Symantec.

 

[JimInKS]

Just got this from Watchguard:

Finally, a unique bug in the worm's network share code can
help administrators learn of a local infection. When attempting to
spread via network shares, Bugbear sometimes sends its infected
.EXE files to network printers. This results in the printers
spitting out pages of useless binary characters and wasting paper
and network printing resources. It's also a sign to the vigilant
network administrator that you have a Bugbear infection somewhere
within your organization.

Sounds like you are an excellent candidate for Bugbear!

 

[edfair]

And boy, it spreads like lightning. Ed Fair
unixstuff@juno.com
Any advice I give is my best judgement based on my interpretation of the facts you supply. Help increase my knowledge by providing some feedback, good or bad, on any advice I have given.

 

[xobyte]

There are two files that are created that start this whole printing mess...at least on my systems. ago.exe and acjh.exe are the two files. The ago.exe spread to each win98 box.

if you try and delete ago.exe it just keeps recreating itself from the acjh.exe.

Solution...boot into safe mode command prompt. go to windows/system dir. delete acjh.exe. then go to the startup folder and delete ago.exe.

On the other 98 boxes the only file that was copied to each one was the ago.exe.

After I deleted them I had no more problems...yet anyway

good luck

Chuck