On Friday 27 Jun 2003 10:17 am, Robin Turner wrote:
Stephen Kuhn wrote:
On Fri, 2003-06-27 at 00:36, Robin Turner wrote:
No, of course I haven't got a virus, but someone on our LAN has, and it's printing garbage (probably its own code) to my Samba printer. One line, one page, so we've got through two reams of paper this week. Short of updating virus definitions and scanning all our Windows boxes (eventually necessary, but a big job, especially since our institution is not subscribed for virus definiton updates) is there a way I can block this?
Sir Robin
Can't you simply blow out all the jobs for that printer, take the printer offline, scan the network for the machine that's attempting to communicate to your Samba printer and then blow it up?
Since the only machines with permissions to print to the Samba server are in our offices, I suspect the "collateral damage" would prove unpopular. The other problem is that these bogus print jobs only come about once a day, so switching the printer off until we got one would not make me popular either, though it is an option.
What tools could I use to sniff for the offending computer?
Sir Robin
How about looking at the log of print jobs. kjobviewer will help you.
I looked at kjobviewer, but it doesn't seem to have a history, just shows jobs in the queue.
Sir Robin
--
"Hackers appear to wear black more because it goes with everything and hides dirt than because they want to look like goths."
- Eric Raymond
Robin Turner IDMYO Bilkent Univeritesi Ankara 06533 Turkey
www.bilkent.edu.tr/~robin
Want to buy your Pack or Services from MandrakeSoft? Go to http://www.mandrakestore.com
