home

Forum HomeMain  SearchSearch  please registerplease register  Log inLog in  FAQFAQ  RULESRULES  
Lexmark include a Trojan with every new printer

 
Post new topic   This topic is locked: you cannot edit posts or make replies.    Forum Index -> PC Protection
View previous topic :: View next topic  
Author Message
alrightbob


 
Joined: 27 Oct 2004
Posts: 125
Location: Dublin, Ireland

PostPosted: Wed Jun 27, 2007 18:39 pm    Post subject: Lexmark include a Trojan with every new printer Reply with quote

I recently bought a new Lexmark P4350 all in one printer. I installed the machine following the instructions. I then noticed a new file installed completely detached from any other. It is called Lx_cats. It is a Trojan that Lexmark bundle with their printer all in one software to record printer and cartridge usage. I was suspicious of it so I googled it. Below is an excerpt from  www.theinternetpatrol.com  explaining what it is.

Do you have a Lexmark printer? If so, you could also have Lexmark’s Lx_CATS spyware — which Lexmark euphemistically calls “tracking software” for “reporting printer and cartridge use back to the company for survey purposes” — living on your computer, without your knowledge.

A user calling himself “Commander” has posted to the printer-focused Usenet group, comp.periphs.printers, that:

“Just the other day I purchased a new Lexmark X5250 All-in-one printer. I installed it as per the instructions and monitored the install with Norton as I do with all new software.

On reviewing the install log I noticed a program called Lx_CATS had been placed in the c:program files directory. I investigated and found a data log and an initialisation file called Lx_CATS.ini. Further investigation of this file showed that Lexmark had, without my permission, loaded a Trojan backdoor on to my computer. Furthermore, it is embedded into the system registry, so average users would likely never know it was there and active.”

Commander noticed that the spyware was programmed to surreptitiously report back to a URL,  www.lxkcc1.com,  every thirty days. lxkcc1.com is registered to Lexmark International, Inc..

When Commander called Lexmark to demand an explanation, the company first denied that they had installed any spyware at all. Ultimately the person with whom he spoke conceded that Lexmark installs “tracking software” on their users’ computers “to report back on printer and cartridge use for survey purposes.” While the Lexmark representative avowed that they did not transmit any personal information, they also admitted that the program does transmit the printer’s serial number, which of course is registered to the user. No personal information my foot!

Rumours of the installation of spyware along with their printer software have swirled around Lexmark for several years, and posts to Usenet complaining of Lexmark spyware date from as early as 2001. Some users complain of their computer trying to connect to the Internet every time they print a document; others worry that the program is reporting not only their cartridge usage, but whether they are using non-Lexmark cartridges, or even refilling their own cartridges, thus possibly setting the stage for a denial of warranty service.

According to “Commander”, the offending files include a program file called lx_CATS, and a related .ini file, lx_CATS.ini, as well as 2 DLL files in the c:program fileslexmark500 folder.

In order to remove Lexmark’s spyware from your system, delete the file (probably in your c:program directory) called “lx_cats.exe”, and also search for and remove a file called “lx_cats.ini” (and, for that matter, any other file including the term “lx_cats”).


Cheeky swines Evil
Back to top
View user's profile Send private message
plodr

Administrator
 
Joined: 12 Apr 2001
Posts: 7760

PostPosted: Wed Jun 27, 2007 18:59 pm    Post subject: Reply with quote

This isn't anything unusual - HP does the same thing (backweb) and other assorted goodies. I don't let my printer thru the firewall - there isn't any need for my printer to go snooping on the internet!

I can only speak about HP because that's the only brand printer I've owned. We have three and all still work.
Back to top
View user's profile Send private message Visit poster's website
alrightbob


 
Joined: 27 Oct 2004
Posts: 125
Location: Dublin, Ireland

PostPosted: Wed Jun 27, 2007 19:21 pm    Post subject: Reply with quote

I did not realise that. I knew certain games installed Trojans for ingame advertising EA's Battlefield 2142 for instance. I would have thought Lexmark and HP would have used their sales and repairs as an indication of their performance.
Zonealarm catches mine trying to access the internet everytime I turn it on. Works perfectly fine with Lx_cats deleted.
Back to top
View user's profile Send private message
blsJason

Administrator
 
Joined: 01 Aug 2001
Posts: 2869
Location: Pacific Northwest

PostPosted: Wed Jun 27, 2007 23:42 pm    Post subject: Re: Lexmark include a Trojan with every new printer Reply with quote

That's it, the X75 that's sitting in my closet is never going to be reinstalled (if the family members that bought it want it to be installed somewhere, they can buy their own computer and mess up that).
The interesting thing is there's no instances of "backweb" on my computer, even though I've had an HP 932C for almost 6 years. (Maybe I was lucky and bought it before they put it on the install CDs?)
_________________
Poetworld subscriber 2002-2012. Frown
Back to top
View user's profile Send private message
winchester73

Malware Response Team
 Malware Response Team

Joined: 01 Mar 2004
Posts: 506
Location: Somewhere along Tobacco Road, North Carolina

PostPosted: Thu Jun 28, 2007 11:49 am    Post subject: Reply with quote

If memory servces, Lexmark Connect is (1) voluntary and (2) fully disclosed during the installation of a new printer.


_________________
Justice for the 96
15/4/89, 3.06pm
Hillsborough, Sheffield
YOU'LL NEVER WALK ALONE

Speak softly, but carry a big Winchester ... Winchester Arms Collectors Association member
Back to top
View user's profile Send private message
alrightbob


 
Joined: 27 Oct 2004
Posts: 125
Location: Dublin, Ireland

PostPosted: Thu Jun 28, 2007 20:19 pm    Post subject: Reply with quote

I have just uninstalled and reinstalled the Lexmark printer and there is no mention of the 'Trojan'. I read through the license and again they keep schtum. The install process is laid out differently to the one you posted Winchester. They have obviously updated it as they see no reason to worry us about the seemingly innocuous background Trojan.
Back to top
View user's profile Send private message
emy


 
Joined: 20 Feb 2012
Posts: 1

PostPosted: Tue Feb 21, 2012 23:52 pm    Post subject: Reply with quote

I too had a same problem while installing my Lexmark printer but once i reinstalled as per manual everything works fine.
Back to top
View user's profile Send private message
bruce bailey

๑۞๑
 
Joined: 11 Apr 2002
Posts: 6000
Location: miami

PostPosted: Wed Feb 22, 2012 1:38 am    Post subject: Reply with quote

After 5 years, most of these are probably in a landfill.
Back to top
View user's profile Send private message
frapper


 
Joined: 14 Feb 2001
Posts: 2500

PostPosted: Wed Feb 22, 2012 9:32 am    Post subject: Reply with quote

emy wrote:
I too had a same problem while installing my Lexmark printer but once i reinstalled as per manual everything works fine.


Where do these people come from and why? A 5 year old post and they post a one-line comment. Then they disappear. This seems to be happening more often. Roll Eyes
Back to top
View user's profile Send private message
blsJason

Administrator
 
Joined: 01 Aug 2001
Posts: 2869
Location: Pacific Northwest

PostPosted: Thu Mar 01, 2012 3:28 am    Post subject: Re: Lexmark include a Trojan with every new printer Reply with quote

frapper wrote:
Where do these people come from and why? A 5 year old post and they post a one-line comment. Then they disappear. This seems to be happening more often. Roll Eyes
Chances are good some of the older threads show up highly in search engine results which attract this kind of thing.
And yes, the Lexmark printer I had has long since been destructed by a local electronics recycler.
We've long since discussed the issue, so I don't think anyone will mind using a little icon on my screen that's been very lonely for a while.
_________________
Poetworld subscriber 2002-2012. Frown
Back to top
View user's profile Send private message
Post new topic  This topic is locked: you cannot edit posts or make replies.     Forum Index -> PC Protection   All times are GMT - 5 Hours
Powered by phpBB ©    
*freedomlist.com assumes no responsibility for any postings
spacer