Remote Downlevel Document issue

[Guest]

Will greatly appreciate if someone can help me with the solution on this:
I have a dedicated print cluster WIN2000 SP4 with 2 nodes. Customers (XP
Pro) notified me that when they come to work in the morning some of the print
devices were out of papers couse they printed out all papers during the
night. The printed docs have several lines at the top in hieroglyphs only.
When checking the logs on the server I found lots of print jobs from the user
(who actually were at home that time) like this: "Document 1500, Remote
Downlevel Document owned by... Size in bytes: 114688; pages printed: 0"
These jobs were sent out to lots of different models of printers. The
customer's PC was checked for viruses with the latest NAV defenitions but I
did not find anything suspicious.
The print ports on the cluster are raw by default with no snmp status
enabled option
Cannot identify the problem. Can anyone help please?

 

[Alan Morris [MSFT]]

this does sound like the virus that copies .exe files to any share it can
find, including printers, thus resulting in the garbage jobs that expel from
the device.
--
Alan Morris
Windows Printing Team
Search the Microsoft Knowledge Base here:
http://support.microsoft.com/default.aspx?scid=fh;[ln];kbhowto

This posting is provided "AS IS" with no warranties, and confers no rights.

 

[Guest]

Sounds like the BugBear virus. See the following link:
http://www.symantec.com/security_response/writeup.jsp?docid=2003-060423-5844-99