Network printing

[Pluto]

Following on the from the resolved local NAS issue, I have another that sounds very similar. It has not come to light sooner because I do very little printing right now. I use a network attached printer on the same network as my NAS. It seems that following a system restart, Windows will not send data to the printer (which remains visible in the print job queue) until I disable, you guessed it, our old pal Web Protection.

This is so very similar to the inaccessible NAS mystery that it simply has to be related. Could someone please go through the appropriate code and see what's going on. Despite the discussion we had earlier on the subject, I am concerned that traffic which begins and ends on my own local network is being blocked. FWIW my printers are configured to use port 9100, presumably using the AppSocket protocol.

[exile360]

Greetings,

An issue with network printers (specifically, the SNMP protocol) is already known and I believe was addressed in one of the recent releases.

Please see if the following corrects the issue:

1. Download and run the Malwarebytes Support Tool
2. Accept the EULA and click Advanced tab on the left (not Start Repair)
3. Click the Clean button, and allow it to restart your system and then reinstall Malwarebytes, either by allowing the tool to do so when it offers to on restart, or by downloading and installing the latest version from here
   

Please let us know if this corrects the issue or not.

Thanks

[Max-H]

59 minutes ago, exile360 said:

An issue with network printers (specifically, the SNMP protocol) is already known and I believe was addressed in one of the recent releases.

Yep, the same printing problem was solved for me then, together with the network problem.

[Pluto]

OK – your message gave me a hint of something to try; sundry protocols were disabled on the printer (SSDP, IPSec, which have been disabled for six or seven years although SNMP has been enabled all along) and re-enabling them has, so far, cleared the issue. Does this make sense? Is the print communication now defaulting to a more secure state with which MB web protection is happier?

I have been using this configuration on the printer unchanged for quite a time (see above) and clearly, something has changed fairy recently but because I seldom print to paper these days, I cannot really say with any accuracy when this issue first arose.

Let's see how it goes for a while; I'm sure others will report their experience in this respect.

Thanks.

[exile360]

Good, I'm glad you were able to get it working.  It may well be that enabling the other protocols helped; I'm not certain, however it might also be that doing so simply forced a refresh of the driver/filter and got the fix in Malwarebytes to 'kick in' so to speak.

If you do encounter any further trouble, I'd recommend trying a clean install of Malwarebytes, then enabling beta updates and installing the beta again, then restarting the system to make sure the latest components are loaded into memory, then test again to see if the issue remains or not.  It may also be necessary to try restoring defaults for the Advanced settings in Exploit Protection as this could also be due to a known issue where Malwarebytes fails to honor the defaults for that component initially.  Based on what I have seen, these networking issues appear to be related to both Web Protection and Exploit Protection which is why I suspect Exploit Protection may also be a factor here.

[Pluto]

OK – I'm afraid this one is still running, and it seems to be along entirely the same lines as the earlier NAS issue. I have done a clean reinstall as asked earlier and can add the following, which is critical to you being able to reproduce the problem. I have two network printers, an old HP LaserJet and a Xerox Phaser 7500, each having a stable IP address on the LAN.

With Web Protection disabled, all is well. When Web Protection is re-enabled, after about 8 minutes the printers appear to go offline – they "grey out" in the "devices and printers" window. Before the point at which they go offline, they remain useable but printing something does not seem to reset any counters – the printers become unavailable when the original 8 minutes (approx.) expires.

But let's get back to the crux of the matter – disable Web Protection and all the printers become available within a few seconds.

[rgrosz789]

On 11/26/2020 at 8:20 AM, Pluto said:

With Web Protection disabled, all is well. When Web Protection is re-enabled, after about 8 minutes the printers appear to go offline – they "grey out" in the "devices and printers" window. Before the point at which they go offline, they remain useable but printing something does not seem to reset any counters – the printers become unavailable when the original 8 minutes (approx.) expires.

But let's get back to the crux of the matter – disable Web Protection and all the printers become available within a few seconds.

I am SO glad to find this message thread. I have been trying to solve the same problem since the beginning of September. I am quite surprised that MalwareBytes web protection is the culprit!!!

I have two network printers, an HP LaserJet 4300 and LaserJet 9040, each having a stable IP address on the LAN. I did the clean reinstall of MalwareBytes as described in an earlier message. After rebooting, I noticed my printers were offline. I then disabled MalwareBytes web protection, rebooted, and now my printers are working properly.

[exile360]

Greetings,

I'm sorry you encountered this issue.  Please do the following to see if it helps:

• Open Malwarebytes and navigate to settings by clicking the small gear icon in the upper right
• Select the Security tab and scroll down to the Exploit Protection area
• Click the Advanced settings button
• Click on the Restore Defaults button on the lower left
• Re-enable Web Protection and restart the system to test and see if your printers are now accessible without having Web Protection disabled
  

Please let us know how it goes.

Thanks

[rgrosz789]

I made the changes you suggested, and it seemed to work after I restarted Windows. For about 10 minutes the HP 4300 printer was available. But then the printer went offline again.

I had to turn off Web Protection and reboot again to use the printer.

[exile360]

I'm sorry to hear that, I was hoping that would work.  Do you use the scan function at all, or just printing for your network printers?  If you just use them to print, disabling SNMP should allow you to access and use your printers on the network with Web Protection enabled.  There should be an option to disable SNMP in your printers' options, please try disabling it, then restart your system and see if it now works consistently with Web Protection active.

[Pluto]

An update that might throw more light on this issue. It appears that SNMP cannot be disabled on either of my printers, so I tried another avenue: select Printer Properties / Ports / Configure Port. There is a check box called SNMP Status Enabled. UNchecking this resolves the problem with MB Web Protection but it prevents Windows (and thereby, any applications running thereon) from detecting whether the printer is on or not. I don't quite understand this because most Windows systems (mine included) do not have the SNMP protocol enabled by default.

So this is, at best, a not-entirely-satisfactory workaround. Bear in mind that there is a considerable timeout between setting up whatever you are testing, and the printer disappearing (or not). As such, it is likely that this problem is rather more widespread among your users than they themselves might realise.

[AdvancedSetup]

No, it's not a satisfactory workaround, but neither are vendors continuing to use SNMP when the industry as a whole has been trying to get everyone to stop using it.

We do hope to have another build soon to address this issue.

 

 

Just for general security reference (mostly concerned with business systems)

Server 2012   -  08/31/2016 from Microsoft

SNMP is deprecated. Instead, use the Common Information Model (CIM), which is supported by the WS-Management web services protocol and implemented as Windows Remote Management.

Server 2016   -  08/22/2019
SMB 2+ over NetBT is deprecated. Instead, implement SMB over TCP or RDMA

Alert (TA17-156A) Reducing the Risk of SNMP Abuse
https://us-cert.cisa.gov/ncas/alerts/TA17-156A

 

[Pluto]

The fact that you have said

13 hours ago, AdvancedSetup said:

We do hope to have another build soon to address this issue

is an excellent sign; as I might have stated earlier, with a slightly knotty bug/issue the biggest problem from a user's standpoint is, very often, getting a developer to accept the bona fides of the problem!

Malwarebytes has a quality reputation and it's reassuring to experience that attitude first hand.

[AlexSmith]

@Pluto @rgrosz789 we just released a new beta build that is designed to address the printer offline issue: 

Please try it out and let us know the results when you can.

Thanks a ton for staying with us as we worked through this difficult issue.

[rgrosz789]

I generally avoid being a Beta tester, if possible.

But this time I made an exception, and installed the beta as you suggested. The printer still seems to be working, and it has been about 15 minutes since I restarted Windows. 

[AlexSmith]

21 minutes ago, rgrosz789 said:

I generally avoid being a Beta tester, if possible.

But this time I made an exception, and installed the beta as you suggested. The printer still seems to be working, and it has been about 15 minutes since I restarted Windows. 

We greatly appreciate you giving this a chance and confirming that things are working better!!

[rgrosz789]

Printer is still working properly today, so I updated my Acronis backup image.

[AlexSmith]

1 hour ago, rgrosz789 said:

Printer is still working properly today, so I updated my Acronis backup image.

Thanks for the update!! Glad to hear this is working!!

[Pluto]

Preliminary tests confirm that access to network printers functions as expected following installation of 4.3.0.98 / 1.0.1130.

It is worth noting that while this update did not demand a Windows restart (on my Win 10 machine), such was necessary for the visibility of network printers problem to be fixed.

Well done and thanks to all who participated in locating and fixing this rather obscure set of problems; let's hope that we can now move on from this tedious issue!

[exile360]

That's great news, thank you for letting us know