Assuring the printer state after the network is compromised by malware, virus, or ransomware attack

Issue description

If a Lexmark printer has been exposed to a compromised or breached network (malware, virus, ransomware, etc.), do the following steps to assure that the printer is in a trusted state.

Solution

1. Disconnect the device from the network (both wired and wireless).



2. Unplug the device, then wait for 30 seconds before plugging back into the main power to ensure that all volatile memory is cleared.



3. Erase printer memory.

   To erase non‑volatile memory or individual settings, device and network settings, security settings, and embedded solutions, do the following:

   

   1. From the control panel, navigate to:

      Settings > Device > Maintenance > Out of Service Erase > Sanitize all information on non‑volatile memory

      For non‑touch screen printer models, press OK to navigate through the settings.

   

   2. Select Start initial setup or Leave printer offline.



4. If the printer has a hard disk, erase the printer hard disk memory.

   

   1. From the control panel, navigate to:

      Settings > Device > Maintenance > Out of Service Erase > Sanitize all information on hard disk

      For non‑touch screen printer models, press OK to navigate through the settings.

   

   2. Depending on the printer model, select ERASE or Continue.

   

   3. Follow the instructions on the display.

   Note:  This process can take several minutes to more than an hour, making the printer unavailable for other tasks.



5. Set up an admin account to restrict access to administrative functions from the network by doing any of the following:

   • Follow the instructions in the Restricting public access to functions, applications, printer management, and security options topic in the Embedded Web Server (EWS) Administrator's Guide.
   • Engage the Secure by default option in the Initial Setup Wizard.


6. Reconnect the device to the network.



7. Reconfigure the device.