Trojan Makes Printers Go Potty The World Over

A Trojan that sends printers crazy, making them print pages of  garbled nonsense until all the paper has been used up, has seen a spike in activity.

Symantec detected the Trojan.Milicenso across various countries, but the worst hit regions were the US and India followed by regions in South America and Europe, including the UK.

Trojan.Milicenso has surged in the last two weeks, but was originally detected in 2010. It infects users’ systems in various ways, including via drive-by downloads and malicious email attachments. Its main aim is not to make printers go crazy, however, but to act as a “malware delivery vehicle for hire”.

Decoy method

The Trojan is somewhat unique in that it  uses adware as a decoy “to distract attention from itself, thereby attempting to avoid malware analysis as this would categorize it as low risk and be dismissed,” Symantec said in a blog post. It is also covered in encryption, making it hard for AV products to analyse.

Yet it makes printers go into overdrive because it loads a .spl file, ostensibly, but not really, for printer spooling.

“The .spl file, while appearing to be a common printer spool file, is actually an executable file and is detected as Adware.Eorezo. Depending on the configuration, any files, including binary files, created in that folder will trigger print jobs,” Symantec said in its blog post.

“This explains the reports of unwanted printouts observed in some compromised environments. Based on what we have discovered so far, the garbled printouts appear to be a side effect of the infection vector rather an intentional goal of the author.”

This side-effect of the malware makes it very easy for IT teams to detect that something is wrong. It does waste plenty of paper, however, and therefore this malware is also a tree murderer.

Are you potty for printers? Try our quiz!