Security Researchers: Recent Rogue Printing Incidents Linked to Second Malware Program
The propagation routine of the W32.Printlove worm can cause the printing of useless data, Symantec researchers say.
A computer worm that propagates by exploiting a 2010 Windows vulnerability is responsible for some of the recent incidents involving network printers suddenly printing useless data, according to security researchers from Symantec.
On June 21, Symantec reported that the rogue printouts were the result of computers being infected with a Trojan program called Trojan.Milicenso.
However, the company's researchers have since determined that the propagation routine of a separate piece of malware, a worm called W32.Printlove, can cause similar problems, Symantec researcher Jeet Morparia said Monday in a blog post.
W32.Printlove infects other computers on the local network by exploiting a remote code execution vulnerability in the Microsoft Windows Print Spooler service that was patched in September 2010. Identified as CVE-2010-2729, this vulnerability was also exploited by the Stuxnet industrial sabotage worm to spread.
W32.Printlove infects other computers on the local network by exploiting a remote code execution vulnerability in the Microsoft Windows Print Spooler service that was patched in September 2010.
The rogue printing behavior can occur when W32.Printlove unsuccessfully attempts to infect a Windows XP computer connected to a shared network printer.
The worm starts by sending a print request to a targeted computer that is specifically crafted to exploit the CVE-2010-2729 vulnerability. If the exploitation attempt is successful, a copy of the malware is dropped in the Windows system directory and then executed.
However, if the system is patched against CVE-2010-2729, a copy of the worm is created in the computer's printer spool directory -- %SystemRoot%\system32\spool\printers -- as a randomly named .spl (Windows Printer Spool) file.
The computer interprets the creation of this file as a new print job and instructs the network printer to print the file's contents, therefore wasting paper and toner.
Because the worm periodically retries to infect a system, the rogue printing behavior will be repeated until all network computers are cleaned, Morparia said. "Tracking down the source of these junk print jobs can be more complicated when there are multiple infections on the network."
Fortunately, the failed infection attempts leave behind .shd files in the printer spool directory that contain details about printing jobs, including the names of computers that initiated them. Administrators can inspect SHD files with a free tool called SPLViewer after shutting down the Print Spooler service, Morparia said.
The W32.Printlove worm might be linked to the previously reported Trojan.Milicenso, Morparia said. "We intend to continue our investigation to confirm any relationship between the two threats."
A 1-2 percent earnings impact may be visible because of companies’ exposure to European markets.
“The Rise of South Indians: Invisible Dimension in Decline of Jobs for Americans in US Economy” says that to fix the broken US IT job market, the monopoly of Teluguites and Tamilians must be ended.
Wi-Fi Router manufacturers selling into the high end of the market have touted upgradeable antennas for years, but none of them have actually sold antenna upgrades until now. Linksys VP Mike Chen told me as far back as the announcement of the audacious WRT1900AC router that the company would develop its own antenna upgrades. Today, Linksys is finally shipping those antennas.
Ubuntu is about to undergo a dramatic overhaul.