Remote Downlevel Document

[Lisa Powell_2]

All three printers start printing a remote downlevel document at around 8.59 every morning. I have HP LJ4050TN, HPC4550, and office jet G. It prints one page which states this program cannot be run in dos mode and then proceeds to print many pages of rubbish. All running win 2000, Job comes from Administrator. Any ideas?

[Roberto_30]

HAve you installed the correct and latest driver ?

Regards Roberto

[Lisa Powell_2]

Yes, I am using the latest drivers - I think it may be the bugbear virus so am just updating all dat files and scanning.

[Alberto Rodriguez_1]

Lisa,

It sounds to me like you may be infected with the Bugbear worm.

Further information regarding this worm can be found in the following links.

http://securityresponse.symantec.com/avcenter/venc/data/w32.bugbear@mm.html

http://vil.nai.com/vil/content/v_99728.htm

http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_BUGBEAR.A&VSect=T

Hope this helps,
Albert

[Lisa Powell_2]

Thank you for your help it was indeed BugBear that was causing the problems. I have found and removed the offending files.

[Lisa Powell_2]

I have updated all the virus files and deleted all finding of the bug bear virus. I am still getting this printing problem. Everything is telling me that it is bug bear but when I sweep all machines I don't find the virus????

[Brian Saunders]

Hi Lisa,

I have exactly the same problem you describe. I???ve searched the net for the reasons for the print file generated and they appear to be :
1. Printer driver problems
2. The Bugbear virus
3. Faulty virus detection software
For virus control I am using the Grisoft (www.grisoft.com) product and have apparently scanned and removed the virus but the problem remains. My system generates the print file either on power up or 10-15 minutes later. The file gets sent to all printers on the network.
Due to the above research I am unclear whether the anti-virus software is helping or not.
The printer problem was certainly there before I installed it. Hence I thnk the most likely cause is the virus itself. But like you I need some help.

Any assistance gratefully received.

[Lisa Powell_2]

I have found that Mcafee have a product called stinger.exe it is a standalone virus scanner and seems to detect and remove the virus. Give it a try.
http://vil.nai.com/vil/stinger/

[Brian Saunders]

Its looking good Lisa, I've used stinger for 4-5 days and it seems to have done the trick.

Thanks.

[Stephen Ashcroft]

I have a very similar problem which is driving my customer brainless. We have done all the issues regarding printer setups, full norton anti-virus (server edition), scanned, etc etc but to no avail.

Not tried the stringer utility.

I would be very interested to know if this fixed the problem as looked promising above.

[Steve Caldwell_1]

I've read a thousand posts all across the web trying to figure this one
out. In Win 2000, NT, and 2003, network printers spit out garbled pages
until the printer is out of paper. We are losing hundreds of sheets of
paper a day to this nuisance. The object appears in the spool as
"Remote Downlevel Document" and cannot be deleted without a long delay.
The only way to stop it is to pull the plug on the printer. Although I
have not completely solved the problem, I have a point of view which I
have not yet come across.


It is important to note that this will only work if the user name on
the RDD is "Guest" (This is the only username I've heard of that causes
the problem.)


If you are on the computer that has the RDD in the printer queue, you
will need to change some security settings for the printer. Go into the
printer's properties. Click the security tab (If this isnt visible, log
in as admin.) Click add, type in "Guest" for the user name" Now, deny
the guest of all printing privledges.


This is simply a work around that is only useful if you don't utilize
the guest user name on your domain.


-- I use WIN2003 Standard as a DC and all of my clients are win XP pro.


--This procedure worked for me for a great deal of time, but the
problem persists here and there.


****--For a network printer...If you cant figure out which pc is
causing the problem...try removing the trays or paper from your printer
and then let it attempt to print the garbage. Then go to every terminal
and see which one is acting up. Then try and change the security
settings.

[Chad Bennett]

FYI - I just had a "Remote Downlevel Document" incident where print jobs from users appeared to be looping in the queue. However, nothing was printing out from the printer. Turns out the problem was the Port got changed on the print server from the TCP/IP address to a "Local Port" and the name of the port was \\print server name\printer share name. Thus, it was printing back to itself. Once the port was changed back to Standard TCP/IP with the correct IP address the problem stopped.

No virus' detected.