Yeah, this is probably W32.Bugbear@mm. The binary being printed is likely the worm itself, according to analysts here. Here's some text from an alert:
** There have been reports that some network printers may be disrupted by the worm's network propagation routine. If a network printer's IP address is scanned, it may begin printing multiple pages of garbage characters. Some printers may have to be reset to resume normal operation. Regards, Cade Cairns On Mon, 28 Oct 2002, Kevin Anderson wrote: > Windows had a virus a couple of weeks back that did that. I'm about 90% > sure it was bugbear. > > It would attack Jet Directs in particular (from memory) > > Kev. > > > > From: <[EMAIL PROTECTED]> > To: <[EMAIL PROTECTED]> > Sent: Monday, October 28, 2002 11:48 AM > Subject: Re: (clug-talk) What to do when CUPS starts to spew? > > > > I am familiar with LPD, and not CUPS. But still wondering if there is > anything like 'permissions' file where the permissions (to print) are set. > Assuming that you are on LAN, make sure it rejects print jobs outside of > your LAN. > > > > If there is no concept of permissions in CUPS, set the print jobs log file > to keep the jobs. This way you can at least track where the jobs are coming > from (i.e. outside of your LAN). > > > > Though not specific, hope this tip helps. Good luck. > > > > - Emin > > > > ----- Original Message ----- > > From: Peter Pankonin <[EMAIL PROTECTED]> > > Date: Monday, October 28, 2002 11:34 am > > Subject: (clug-talk) What to do when CUPS starts to spew? > > > > > It started on Friday: > > > > > > The printers (two of them -- a Lexmark and a Canon) configured > > > through CUPS > > > started printing a job. On the first page it says > > > > > > MZ (then some random characters followed by) !This program cannot > > > be run in > > > DOS mode. followed by some more characters. > > > > > > It then prints one line of code per page and empties the printer. > > > This > > > repeated four or five times on Friday and has happened again three > > > times this > > > morning. > > > > > > I've looked through the chron jobs, KJobViewer, Print Job > > > Administration tool, > > > but can't find where this job is coming from. Any ideas? > > > > > > > > > > > > > > > >
