daily HPxxxxxx.cfg are created

[drrank]

Hi,
i notice that in the c:\WINNT\system32\spool\drivers\w32x86\3 are creating daily this HPxxxxxx.cfg files where xxxxxx are random numbers and letters, is a configuration file for a printer in format xml. this is some sort of virus?

the system is a windows 2000 advanced server
printers installed are a 2100 and a 2550 HP printers.

thanks in advance

 

[satrow]

Hi drrank, I don't think that's a virus; it may be related to a bug I've seen in Win2K where the machine insists on installing the printer anew after every reboot or startup - you can check for this in the System logs.

 

[drrank]

Hi satrow,
thanks for answering so fast.

indeed in the system logs continuosly log the following

id 9 event print

Printer <printer name>/<computer name> Session <number> was set.

what thrills me is that computer name is not computer name of the machine but another machine in the domain

and also appears

id 2 event print

Priority of document <document name> on <printer name>, owner <owner name>, was changed from <initial priority> to <changed priority>.

this happens continuosly, not only in reboot

 

[2ffat]

Do you happen to have shared printers? I see this with shared printers. Some PC will create a session on another PC for the shared printer. I see it alot on Terminal Services.


James P. Cottingham
-----------------------------------------
[sup]I'm number 1,229!
I'm number 1,229![/sup]

 

[drrank]

Hi 2ffat,

the printer is shared in another machine in the domain, the machine who shares is a DC of the domain and the machine with problems with the files creating is also a DC, the two machines are windows 2000 advanced server, the machine with the problem is also a exchange 2000 server.
the machine with the session that is generating logs is a client machine within the domain

thanks in advance