Windows 7 Whacky ghost printing problem

[winky51]

This one is a doozy.

Small office environment (2 laptops)

They have a HP Color LJ CM2320fxi printer and a HPO M2727np B/W printer

Both printers mysteriously and simultaneously started spewing out hundreds of pages of nonsense, 10 characters to 2 lines.

Diagnosed it down to one of the laptops. It has Windows 7 32b professional.
Used print manager....
Nothing in queue
Removed drivers
Reinstalled new drivers
Same results. I turn on PC and in 15m the printers start spewing

Removed both printers and drivers
Same results. I turn on PC and in 15m the printers start spewing

Installed downgraded generic versions of drivers for both printers for younger model HP printers of appropriate type
Same results. I turn on PC and in 15m the printers start spewing

Removed all the extra HP software from startup and services
Same results. I turn on PC and in 15m the printers start spewing

The client has had this problem for 2 weeks and didnt advise me on it so I cant do a restore point. Windows backup only has a copy of the latest OS which is later than the date this started happening.

Ran a virus scan and nada (just in case)

Nothing in queue. This setup has been working for over a year.

Ive been in IT for 15 years and have never seen anything like this.

 

[Saltgrass]

Are these wired or wireless printers, if on a network, what else might have access? Could another device be printing through the laptop?

Since it only happens when the one laptop is turned on, this probably isn't relevant, but have you cleared the cache on the printers?

Are there differences in what might be running on the two computers, in Task Manager, or the Services Control Panel? Does anything show up as using CPU time?

 

[winky51]

other computer + printers are wired to a router. The laptop is wireless.

Printers dont have a hard drive, so simply removing power cable wipes them out. I did look for a clear cache on both just in case and there was none on the printer itself.

Nothing shows in processes, nothing in event viewer, no other device on the network. I can only guess its some program that sends this job.

The 1st page of this prints out "HTML 1.0....." then goes on. I thought it was a website he printed but there is simply nothing anywhere to indicate anything. I asked a MS systems engineer and even he is baffled. Never seen this before.

 

[winky51]

Almost forgot. I also removed all other network protocals from the printers in their setup except the IPv4

 

[Saltgrass]

It is a little strange both printers would do the same thing, since normally print jobs are directed only toward one. I suppose if the first one did not work correctly, the second one might have been tried also.

Depending on how much memory the printers have, a print job may need some time to transmit or it might happen quickly and leave it in the printer's queue.

Has the printout ever finished?

My HP Color Laser (wireless print server) will print out multiple junk pages if the output has been corrupted and gotten out of sync somehow. When that happens, I can reset the unit and it will go back to normal.

Can you run the suspected laptop in a wired condition and disable the wireless? I will assume disabling the wireless does stop the printout.

 

[Trouble]

A confusing issue indeed.
Search and search on this problem and found only one mention of possible corruption if the problem machine is running Sandboxie and possibly a remote desktop session as host. Not sure if this is applicable to your issue or not.
There are also several print spooler service exploits so of course make sure that the problem machine(s) are Patched, Updated, Service Packed and hotfixed.
Do I understand correctly, that even with no printer(s) installed (drivers and or software) on the problem machine, that simply turning on the machine will start the issue after 15 minutes or so?
Check msconfig and see what you have in there that might be starting up at or shortly after boot (delayed start) that might be causing the issue.
Autoruns.exe may also help in determining what is running at startup.
Regards
Randy

 

[winky51]

I removed both printers and it still was printing. But I didnt remove both printers, reboot, and test. I hit cancel on the printers and the jobs still kept coming.

The jobs are literally random characters. The only hint is that the 1st page says "HTML 1.0..." on it. I see occasional words that look like a menu choice. To me it might be a webpage. But the printing never stops.

When I see something like this the data is sent in a format that the printer doesnt understand and it spits out garbage.

He has Picassa installed. One thing I notice is this HP drop box. So you sent a doc to the printer (it prints before the 15m) and this box pops up from HP saying (your doc was sent) and I cant seem to find a way to remove it.

 

[winky51]

Ok I figured it out.

iYogi (remote desktop support company for $30 a month) installed nmap.exe on the PC. It apparently was a recent upgrade to their packaged of software.

You cant simply uninstall nmap.exe (real program) from the system iYogi will automatically reinstall it on next boot. You have to uninstall the "network analyzer" from the iYogi software package to get rid of it.

nmap.exe is a network security scanner, thus hitting all the ports on the network, thus why the printers were going nuts.

I went nuts because I saw no install of anything new and my client had iYogi for over a year. Just blind luck where I saw this odd program and thought "WTF is that" and I looked it up. Then bingo between a reply in the HP forums put 2+2 together.