Virus targeting my print server

  • Thread starter Thread starter Brian Gibson - Wheaton College
  • Start date Start date
B

Brian Gibson - Wheaton College

We are running a win2k server as a printserver. I noticed
today that the indicator for bytes sent and bytes
received was lit up constantly. I ran performance monitor
and netmon and it showed 2 MAC addresses hitting it with
large amounts of data (5-15MB just about every second)
and for all the data that was thrown at it, the server
spit back almost the same amount of traffic. This was
with no print jobs in the queue. We also mirrored the
traffic at the switch to a machine running ethereal and
it shows tons of the following.

get print request
open printers
close print request

This happens constantly. Any ideas? We have shut down the
2 student ports that are causing the most problems and we
are going to make sure they have the latest virus
scanning software and we'll check out their PCs. Any help
would be very much appreciated
 
Many of the Major Antivirus vendors have free scanning tools. You can run
one or more of them along with your AV software to look for a virus.

You may also want to look at what processes & services are running to see
if there is anything unussual.

You can also see what applications are starting up. In addition to the
startup folders, here are some registry places you can look:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session
Manager\KnownDLLs
HKEY_LOCAL_MACHINE\System\ControlSet001\Control\Session Manager\KnownDLLs
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Current Version\Run
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Current Version\RunOnce
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Current Version\RunOnceEx
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows
("run=" line)
HKEY_CURRENT_USER\Software\Microsoft\Windows\Current Version\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\Current Version\RunOnce
HKEY_CURRENT_USER\Software\Microsoft\Windows\Current Version\RunOnceEx
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServices
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows
("run=" value)

I hope this helps

Rich

This posting is provided "AS IS" with no warranties, and confers no rights
 
Back
Top