Normal netbios printer activity or what

tcog · 10-28-2009, 11:07 AM

OK, This is my very first post here so sincere appologise for any typo's or bad spelling, and of course if its in the wrong post area.

The issue is a suspect PC, having been very well cleansed, suddenly started to heve difficulty getting a DHCP allocate ip address. Lots of work later, I stuck it onto a hub and tried to look at the traffic using wireshark on an dirrerent xp machine (release 1.2.2).

Traffic is interesting, after some time the suspect PC attempts to create a printer on the first pC on my network. syntax is SPOOLSS AddPrinterEX request. When it is denied, it does the same with the next PC, untill it has tried every PC on my network in that workgroup. ( I Have significantly abbreviated the "conversations" to simplfy life). IT also attempts to do a rsql attach to a PC running microsoft sql.

According to Sophos uk call centre there is NO virus or malware on the suspect machine, but neither do they say this is "normal" behaviour.

As I don't use netbios if can avoid it (Netware with Client32 is the networking environment) My query to you good people is :-
Am I stupid ? am I missing something very obvious ? or is this normal.

Any hints suggestions very welcome.

TTFN

**johnwill** · 10-28-2009, 03:08 PM

I think you need to find someone that knows Netware, it doesn't sound normal to me, but I'm not a Netware person.

tcog · 10-29-2009, 03:35 AM

ta, but we have removed all the novell client etc ( just to ensure that was not the issue). Wireshark shows NO netware traffic to/from this box.
This box only has the microsoft client netbios, and runs tcp to our internet firewall. Hence my confusion as to why it attempts to install printers over the LANMAN network.
I agree it don't seem reasonable. I even "removed" everything I could from the task manager. Left only 22 essential tasks including anti-virus BUT it still occurs.

Getting very confused.

10-28-2009, 11:07 AM	#1 (permalink)
tcog Registered User Join Date: Oct 2009 Posts: 2 OS: win 7	Normal netbios printer activity or what OK, This is my very first post here so sincere appologise for any typo's or bad spelling, and of course if its in the wrong post area. The issue is a suspect PC, having been very well cleansed, suddenly started to heve difficulty getting a DHCP allocate ip address. Lots of work later, I stuck it onto a hub and tried to look at the traffic using wireshark on an dirrerent xp machine (release 1.2.2). Traffic is interesting, after some time the suspect PC attempts to create a printer on the first pC on my network. syntax is SPOOLSS AddPrinterEX request. When it is denied, it does the same with the next PC, untill it has tried every PC on my network in that workgroup. ( I Have significantly abbreviated the "conversations" to simplfy life). IT also attempts to do a rsql attach to a PC running microsoft sql. According to Sophos uk call centre there is NO virus or malware on the suspect machine, but neither do they say this is "normal" behaviour. As I don't use netbios if can avoid it (Netware with Client32 is the networking environment) My query to you good people is :- Am I stupid ? am I missing something very obvious ? or is this normal. Any hints suggestions very welcome. TTFN

10-28-2009, 03:08 PM	#2 (permalink)
johnwill Manager, Networking Forums Join Date: Sep 2002 Location: S.E. Pennsylvania, US Posts: 41,685 OS: Windows 7, XP-Pro, Vista, Linux Blog Entries: 1	Re: Normal netbios printer activity or what I think you need to find someone that knows Netware, it doesn't sound normal to me, but I'm not a Netware person. __________________ If TSF has helped you, Tell us about it! or Donate to help keep the site up! Microsoft MVP - Windows Desktop Experience

10-29-2009, 03:35 AM	#3 (permalink)
tcog Registered User Join Date: Oct 2009 Posts: 2 OS: win 7	Re: Normal netbios printer activity or what ta, but we have removed all the novell client etc ( just to ensure that was not the issue). Wireshark shows NO netware traffic to/from this box. This box only has the microsoft client netbios, and runs tcp to our internet firewall. Hence my confusion as to why it attempts to install printers over the LANMAN network. I agree it don't seem reasonable. I even "removed" everything I could from the task manager. Left only 22 essential tasks including anti-virus BUT it still occurs. Getting very confused.