Photo.scr Virus Causing Bizhub C550 To Print until out of paper

**bungapads** · 10-20-2016

If i leave my machine on, I get a file photo.scr file that starts a print job and then prints all the paper in the machine. This keeps happening. It happens multiple times in the history, usually hours apart once from Admin and once from ftp. does anyone know how to "scan" or remove this virus from a C550 Bizhub? (photo.scr). Do you know anything about this issue? Help

**tech51** · 10-20-2016

Surely this a problem with your computer system, not the copier.
Ive never heard of a copier getting a virus.

**tech51** · 10-20-2016

Although having read another thread where you say you reloaded a fiery, there's a chance you have got a virus on that.
Where did you get the fiery software from?

**bungapads** · 10-20-2016

Originally Posted by tech51

Although having read another thread where you say you reloaded a fiery, there's a chance you have got a virus on that.
Where did you get the fiery software from?

I got the software from a copier tech (supposedly from Konica Minolta) from this forum. I actually shut my computer off and then left the printer on last night with a small amount of paper in it. Sure enough when I came in all the paper was printed. There were two print jobs, one said the source was Admin and the other was FTP. The first page always says "This program cannot be run in DOS mode" and then each page is printed with random letters and symbols, a couple lines per page. The jobs are 900 plus pages. the name of the print job is photo.scr. I checked wtih various companies and have run all types of virus scan, etc on the computer, but no luck finding the photo.scr file.

Can the machine be printed to from a remote location? If so, could i disable this feature? How?

Bizhub C550.

If you think I need to redo something or reinstall something, what would that be? and, do you have the files?

**bungapads** · 10-20-2016

Originally Posted by tech51

Surely this a problem with your computer system, not the copier.
Ive never heard of a copier getting a virus.

I got the software from a copier tech (supposedly from Konica Minolta) from this forum. Yesterday, I actually shut my computer off and then left the printer on last night with a small amount of paper in it. Sure enough when I came in all the paper was printed. There were two print jobs, one said the source was Admin and the other was FTP. The first page always says "This program cannot be run in DOS mode" and then each page is printed with random letters and symbols, a couple lines per page. The jobs are 900 plus pages. the name of the print job is photo.scr. I checked wtih various companies and have run all types of virus scan, etc on the computer, but no luck finding the photo.scr file.

Can the machine be printed to from a remote location? If so, could i disable this feature? How?

Bizhub C550.

If you think I need to redo something or reinstall something, what would that be? and, do you have the files?

**Albonline** · 10-20-2016

isolate the copier from the network, see if it still does the dump. myself i would reset everything to factory defaults and reflash with a known good copy of the firmware.

**emujo** · 10-20-2016

Print jobs like this can also be the result of Post Script files sent to the PCL driver. I have heard from one of our customers that a similar issue was caused by an attack through port 25 SMTP Non SSL. If you are using the device for mail you may want to try using SSL or TLS. Emjjo

**bungapads** · 10-20-2016

Originally Posted by Albonline

isolate the copier from the network, see if it still does the dump. myself i would reset everything to factory defaults and reflash with a known good copy of the firmware.

Thanks for your suggestion. It was such a travail to reset factor defaults and reflash nvram last time. It took my days to figure it out. I also do not have access to the file, except the ones given to me before. If you have or know where i could get the files and instructions that would be appreciated. Would this reformat the harddrive inside the machine? Maybe that is where the virus is.

Do you know if there is any way to scan the C550 with virus software?

Thanks

Ron

**bungapads** · 10-20-2016

Originally Posted by emujo

Print jobs like this can also be the result of Post Script files sent to the PCL driver. I have heard from one of our customers that a similar issue was caused by an attack through port 25 SMTP Non SSL. If you are using the device for mail you may want to try using SSL or TLS. Emjjo

Thanks for your input. Could you direct me to the service or repair manual that can guide me through how to do or change these settings?

Do you know of any way to scan the C550 to find the culprit (photo.scr) file?

Thanks