Solved

Suspect Network Printer Infected by Virus

Posted on 2003-11-20
14
1,126 Views
Last Modified: 2013-12-07
We have a stand alone network printer running TCP/IP that is connected to our network via CAT-5 to our switch.  Our broadband internet bandwidth has been running at 25kbps but when we unplug the printer from the switch, our bandwidth increases to 1.2mbps (normal speed).  The activity light on our switch also goes crazy when the printer is plugged in.

The printer is a Xerox Phaser 860.

Could this possibly be a virus that has infected the printer itself or some other problem (ie. printer is simply malfunctioning)?  

Tks.
0
Comment
Question by:jeffmsas
  • 3
  • 3
  • 3
  • +3
14 Comments
 
LVL 32

Expert Comment

by:LucF
ID: 9789424
Hi jeffmsas,

As far as I know there are no virusses for printers, but maybe your internetrouter let's it send outside the LAN, try blocking access to the internet for the printer.

Greetings,

LucF
0
 

Author Comment

by:jeffmsas
ID: 9789443
The printer itself doesn't have a username on the network so how can we block access to the internet for the printer?
0
 
LVL 32

Expert Comment

by:LucF
ID: 9789491
You can block the IP adres wich your printer uses.
0
Connect further...control easier

With the ATEN CE624, you can now enjoy a high-quality visual experience powered by HDBaseT technology and the convenience of a single Cat6 cable to transmit uncompressed video with zero latency and multi-streaming for dual-view applications where remote access is required.

 
LVL 34

Accepted Solution

by:
PsiCop earned 100 total points
ID: 9789626
Viruses are OS- or application-specific. Unless the Phaser 860 runs something vulnerable like Windoze, its highly unlikely that some virus has magically installed itself in the printer.

Your problem could be something as simple as a malfunctioning NIC in the printer that's sending out a lot of garbage frames or packets, overloading your router interface. If you can swap NICs in the printer, try that.

Also verify that the UTP cable plugged into the printer is good (try swapping it with another known-good cable).

Perhaps the switch port is bad - try a different switch port.
0
 
LVL 16

Expert Comment

by:The--Captain
ID: 9791164
Have you tried using a sniffer to watch exactly what sort of crazy traffic the printer is generating?  That would go a long way towards solving your problem.

Cheers,
-Jon

0
 
LVL 21

Expert Comment

by:wyliecoyoteuk
ID: 9791499
I would login to the printer`s webserver and disable:
1) all protocols which are not needed(e.g. appletalk, IPX/spx etc.)
2)ensure that NO gateway is set (some printer utilities will search for ever for an smtp management server for instance)
3)disable IPP (internet printing protocol)
4)remove the printer's mac address or IP address from the allowed hosts on your router.
review what ports and utilities  you use to connect to this printer.Some software will only work satisfactorily on a self containred LAN, and will cause havoc on a WAN
0
 
LVL 1

Expert Comment

by:ThePowderedToastMan
ID: 9791919
These types of problems usually indcate a bad NIC.
0
 
LVL 34

Expert Comment

by:PsiCop
ID: 9797465
I thot I said that. :-)
0
 
LVL 21

Expert Comment

by:wyliecoyoteuk
ID: 9799994
Also, a lot of printers and MFPs these days actually run winnt, win2k, NetBSD and Linux as operating systems!
(Ricoh MFPs= NetBSD, early Ricoh colour = Windows Atwork, Konica = NT4 or win2K, Toshiba MFPs = Linux, etc.)

These days , network connected printers and MFPs are PCs connected to a scanner and printer in one box, often running a specialized version of an established OS.

The biggest mistake you can make is to set a gateway in the printer`s settings.

We have had hackers attack network printers  via SNMP, thinking that they are a router or other network device.
0
 

Author Comment

by:jeffmsas
ID: 9800204
I just wanted to let everyone know that we are still having the problem.  I've tried filtering the printers IP address and port in the broadband router config.  I've removed the gateway from the printer's network settings and any other protocol that I thought would help, I've reset the router and printer, I've moved the printer to a different port on the switch, nothing seems to help.  We talked to a Xerox lead support tech and he said he's never experienced this before.  I also called our internet service provider and they don't see a problem either.  

The only way we can kill the traffic between the printer and internet is to unplug the printer from the switch.

I'm still working on the issue.  I'll post again when we get a fix for it.  Tks.

0
 
LVL 1

Expert Comment

by:ThePowderedToastMan
ID: 9800277
PSIcop - a simple concurrence, no point stealing intended old chap-

Jeff, PULL THE NIC AND PUT A NEW ONE IN!

TOPTM
0
 
LVL 34

Expert Comment

by:PsiCop
ID: 9800409
Remind me not to buy any Konica network printers...

TPTM - No problem
0
 
LVL 21

Expert Comment

by:wyliecoyoteuk
ID: 9816489
If you are still having problems,  PSIcop is probably right.
0
 

Author Comment

by:jeffmsas
ID: 10496279
Replaced defective switch.  Tks PsiCop.
0

Featured Post

Portable, direct connect server access

The ATEN CV211 connects a laptop directly to any server allowing you instant access to perform data maintenance and local operations, for quick troubleshooting, updating, service and repair.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Meet the world's only “Transparent Cloud™” from Superb Internet Corporation. Now, you can experience firsthand a cloud platform that consistently outperforms Amazon Web Services (AWS), IBM’s Softlayer, and Microsoft’s Azure when it comes to CPU and …
When it comes to security, there are always trade-offs between security and convenience/ease of administration. This article examines some of the main pros and cons of using key authentication vs password authentication for hosting an SFTP server.
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
In this tutorial you'll learn about bandwidth monitoring with flows and packet sniffing with our network monitoring solution PRTG Network Monitor (https://www.paessler.com/prtg). If you're interested in additional methods for monitoring bandwidt…

808 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question