search for: spoolss_addprinterex

...me advice from gurus. I identified several Windows NT computers, that are persistently trying to access my samba server. They are connecting to IPC$ with NULL information both in password and username fields. Below you will find excerpt from samba log file. My questions would be following. What is SPOOLSS_ADDPRINTEREX ? Can it be some kind of worm ? If yes, how I can catch it (enable write to spool dir, add printer wizard, etc.) ? Can somebody let me know anything about persistently coming connections from same hosts and doing below posted actions ? Thank you in advance ! [2005/09/15 22:34:44, 3] smbd/service...

...8) Got API command 0x26 on pipe "spoolss" (pnum 7093)free_pipe_context: destroying talloc pool of size 0 [2003/08/08 16:46:06, 3] rpc_server/srv_pipe.c:api_pipe_request(1423) Doing \PIPE\spoolss [2003/08/08 16:46:06, 3] rpc_server/srv_pipe.c:api_rpcTNP(1476) api_rpcTNP: rpc command: SPOOLSS_ADDPRINTEREX [2003/08/08 16:46:06, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(544) free_pipe_context: destroying talloc pool of size 474 [2003/08/08 16:46:17, 3] smbd/process.c:process_smb(878) Transaction 6814 of length 628 [2003/08/08 16:46:17, 3] smbd/process.c:switch_message(673) switch message SM...

...api_fd_reply(294) Got API command 0x26 on pipe "spoolss" (pnum 725f) [2005/06/11 17:30:14, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) free_pipe_context: destroying talloc pool of size 0 [2005/06/11 17:30:14, 3] rpc_server/srv_pipe.c:api_rpcTNP(1538) api_rpcTNP: rpc command: SPOOLSS_ADDPRINTEREX [2005/06/11 17:30:14, 3] rpc_server/srv_pipe_hnd.c:free_pipe_context(542) free_pipe_context: destroying talloc pool of size 244 [2005/06/11 17:30:14, 3] smbd/process.c:process_smb(1091) Transaction 7 of length 45 [2005/06/11 17:30:14, 3] smbd/process.c:switch_message(886) switch message SMBcl...