Worm Alert

A simple worm detector in PocoScript for PocoMail

This script scans the names of attachments and raises an alarm when it finds something suspicious. It looks for

• names of attachments that have been used by worms
• evidence of attempts to conceal a file's type
• words beloved by worm runners
• active file types

The Zip archive contains the script Worm Alert.poc and data files. Extract the entire archive to your Scripts folder. Configure a filter for all incoming mail to call the script Worm Alert.poc.

Program updated 2004-07-07.
Data file updated 2008-01-22

Deploy conventional anti-worm defences, by all means. But there's room for redundancy here. Your favourite worm whacker might be an excellent product. Or it might not. Or it might have been incapacitated by malware. It might have been deactivated by a user. It might be configured improperly. If it operates by means of registered file associations, these associations might have changed. There's room for redundancy. Oh, all right! The script is a toy for my own amusement.

The script may also be run for outgoing and selected messages.

For this script to be effective, the PocoMail option "When receiving attachments, leave attachments encoded inside the message" must be UNCHECKED. It should be unchecked for security in any case.