Tuesday, May 9, 2000

5/9/2000 5:57:13 PM

• A worm by any other name. The man arrested or detained or questioned in the Philippines in the matter of the recent worm unpleasantness may well need a lawyer. But he clearly is also in desperate need of a publicist. Remember the first rule of public relations: never disparage what they write about you, as long as they spell your name right.

  Tell it to Mr. Ramones or Lamores or Lamore or Ramores or Lamores or Ramoen (age 27 or 32 or 35 or mid-30s) and his wife or girlfriend Irene or Aireen Guzman or de Guzman (age 23 or 24 or 25 or 28) and her sister Jocelyn, perhaps their babysitter, and maybe another brother and what about the baby?

  This research was done by B.K. DeLong <bkdelong at zotgroup dot com>.

  Reomel Ramones
  • (AP) Ramones: mid 30s; Irene Guzman's sister: 23
  • (Wired) Ramones: 27; Irene Guzman: 23
  • (CNN) Ramones: 27; Irene Guzman: 23
  • (Reuters) Ramones: 27; Irene de Guzman called "girlfriend"
  • (Agence France Presse) Ramones: 27; Guzman mentioned; sister Jocelyn called their babysitter
  • (Agence France Presse) Ramones: 27; Irene Guzman: 25, listed as wife; sister Jocelyn: 23, called their babysitter
  Rommel Lamores
  • (Phillipine Daily Inquirer) Lamores: 27; Irene Guzman: called "live-in partner"; her sister Jocelyn is mentioned
  Rommel Lamore
  • (Manila Bulletin) Lamore: 35; Irene: 28, called his wife; no last name mentioned
  Rommel Ramores
  • (ABS-CBN) Ramores: 32; neither Guzman nor sister mentioned, only a 23-year-old AMA student
  Riomel Lamores
  • (Phillipine Star) Lamores: 27; Guzman: listed as live-in partner
  Reonel Ramoen
  • (Manila Times) Ramoen: 27; Aireen de Guzman: 24

Monday, May 8, 2000

5/8/2000 10:57:06 AM

• Procmail detour for all .VBS viruses. Jason Jordan was able to protect the Australian government agency where he works against the VBS/LoveLet.A worm and most of its imitators by dropping this Procmail script in the /etc directory of the agency's Linux mail gateway. This quick fix detours any email containing a .VBS attachment to a secure file and notifies the sender about a possible virus.

  In some recent variants of the VBS/LoveLet.A worm, the attachment is ZIP'd or uuencoded (and Outlook kindly decodes it before running it). This script wouldn't block those variants.

  
    LOGFILE=/var/log/procmaillog
     COMSAT=off
    
     :0 B
     * ^Content-Disposition:.* 
     * .*.vbs.*
     * !^FROM_DAEMON 
     * !^X-Loop: vbscheck 
     {
    
     SUBJECT=`formail -xSubject:`
     ARRIVED=`formail -xDate:`
    
         :0 c
         /var/log/procmail.filtered
    
         :0
         | (formail -rt -A"Precedence: Virus" -A"X-Loop: vbscheck"; \
         echo "ATTENTION:"; \
         echo " "; \
         echo "The Mailer-Daemon at" $HOST "successfully received email from you"; \
         echo "on $ARRIVED with the subject: "$SUBJECT; \
         echo " "; \
         echo "However, it has found evidence of something that it believes to be"; \
         echo "a virus."; \
         echo " "; \
         echo "As a result, your email was NOT delivered to the recipient."; \
         echo " "; \
         echo "If you believe this to be a mistake, please email postmaster@"$HOST; \
         echo " "; \
         echo "Unless this is the case, please do not respond to this mail, it is"; \
         echo "an auto reply."; \
         ) | $SENDMAIL -oi -t -fpostmaster@$HOST
     }
  	

Sunday, May 7, 2000

5/7/2000 5:01:31 PM

• Simple Registry fix for all .VBS viruses. The following simple script will cause future VBScript attachments to open in Notepad instead of executing. Run it and then laugh as Outlook engages in the riskiest form of online behavior. Thanks to Steven John Mapua for conceiving this simple fix and to Tim Heiner for passing it along. The script was extended as noted by Chris Adams, who wrote, "I'm going to be adding this to our domain login script ('regedit /s file.reg' will import the registry settings without the normal popup window) to automatically take care of all of our desktops."

  
    REGEDIT4
    //
    // Copyright © 2000 Steven John Mapua
    // Extensions for everything other than .VBS contributed by <chris@digitaria.com>
    // Freely distribute
    [HKEY_CLASSES_ROOT\.VBS]
    @="txtfile"
    "Original_Default"="VBSFile"
    [HKEY_CLASSES_ROOT\.VBE]
    @="txtfile"
    "Original_Default"="VBEFile"
    [HKEY_CLASSES_ROOT\.WSF]
    @="txtfile"
    "Original_Default"="WSFFile"
    [HKEY_CLASSES_ROOT\.WSH]
    @="txtfile"
    "Original_Default"="WSHFile"
    [HKEY_CLASSES_ROOT\.JS]
    @="txtfile"
    "Original_Default"="JSFile"
    [HKEY_CLASSES_ROOT\.JSE]
    @="txtfile"
    "Original_Default"="JSEFile"