Inactive Networked Printer Sending Spam

[Daniel Latu]

We have a networked printer in our office, that we have been notified now daily from our ISP that it is sending spam (we found this out, as we checked all networked pc's and the server, and all antivirus was up to date, then ISP informed us of IP address which turned out to be the printer).

We have had a printer guy in to re-install firmware, which he did, this did not work.

Unfortunately there is a two fold problem we are having with the printer, about 2 months ago (probably when someone hacked our server) the printer stopped being able to scan pages to a network folder. There is a file once scanned, but only partial, so PDF won't open. the printer guy connected directly to printer, and had no problem with scanning to folder, he guesses that the printer is not connecting to the network folder for long enough, not sure how to fix this.

The work around we have had for 2 months, has been to scan and email ourselves any pages requiring scanning, however with this virus sending spam from the printer, the only way anyone can think of stopping this is to block the printer from sending emails. Which is why this is a two fold problem, if we block emails, the spam is fixed, but can't scan pages.

Can anyone suggest a solution to either or both problems:

1) Get rid of the virus on the printer...if the printer guy doesn't know then it's obviously not easy.
2) Fix the printer scanning to folder on the network.

We have had our IT guys and Printer guys trying to fix both problems for 2 months, without any joy, and our ISP is not happy.

Thanks
Dan

 

[Broni]

Welcome aboard

This is something I've never heard of.
My first question what kind of printer is it which is able to send emails?
I simply can't picture the whole setup.
Obviously we can't scan printer since it doesn't have any operating system.
I'd rather suspect some networked computer being infected.

 

[Daniel Latu]

It's a large office printer, HP. Not in the office today, so can't check model number. Two lots of IT companies have both said its definitely the printer sending the spam.

 

[Broni]

You're not really answering my questions.
Possibly your IT people can provide some more info.

I'm simply not aware of any printer being able to send emails.
I need to know how it's technically possible.
I know there are printers which have their own email addresses which allow you print remotely from them but I'm not aware of printers being able to send emails.
I understand that a network printer must have its own IP address but that can be easily spoofed.
It'll look like something has been sent from printer's IP address but in fact something is being sent from some other device (computer) connected to the same network.
An email address can be spoofed as well.
So if your ISP/IT people say that the printer is sending something because they see printer's IP/email address in spam messages it doesn't necessary means this is the case.

Until I'll get some more info all I can suggest is to check all networked computers for some infection.

 

[Daniel Latu]

Every single device on the network has been scanned for viruses. Sorry, but every company I have worked for in the last few years has had printers that scan and email, so not sure why your saying you haven't heard of it.

 

[Broni]

This is exactly what I'm saying.
I'm not saying they don't exist. I'm saying I haven't heard of them.
I don't work at offices so I'm not familiar with such devices.

I've only heard of such possibility like infected printer (http://tonerideas.wordpress.com/201...-with-virus-it-might-be-the-trojan-milicenso/) but personally since it's not a computer I have no idea how to deal with it.

IF that's the case.