This program scans your local drives for the AutoStart 9805 worms. It is based on published descriptions of the activities of these worms. It has not been tested on live worms. At this writing, variants A through F of the worm are known.
Besides the known worms, WormScanner will also tell you about “suspicious” files, namely autostart applications and invisible extensions. Bear in mind that these suspicious files might have been installed by commercial software for innocent purposes, although I personally have difficulty imagining a legitimate purpose for making an extension invisible. I do know of one case in which a demo version of a commercial application installs an invisible extension as part of a copy protection scheme. However, in that case, the extension lacks a resource fork, and therefor will not really run as an extension. WormScanner will not report such fake extensions.
Worms may lurk inside disk image files, but unless the disk image is mounted, WormScanner will not be able to look inside.
WormScanner can run in three modes: Interactive, Automatic, and Passive. Initially it will be in Interactive mode, but you can change it by choosing the Preferences menu item.
Interactive mode:
• WormScanner will automatically delete known worm files, if possible. If it is not possible to delete the file, then WormScanner will attempt to make it visible and move it to the trash.
• When WormScanner finds a suspicious file (autostart application or invisible extension), WormScanner will ask you whether to delete it or not.
Automatic mode:
• WormScanner will automatically delete known worm files, if possible. If it is not possible to delete the file, then WormScanner will attempt to make it visible and move it to the trash.
• WormScanner finds a suspicious file (autostart application or invisible extension), WormScanner will note it in the transcript, but do nothing about it.
Passive mode:
• WormScanner finds a known worm file, WormScanner will note it in the transcript, but do nothing about it.
• WormScanner finds a suspicious file (autostart application or invisible extension), WormScanner will note it in the transcript, but do nothing about it.
I have provided an AppleScript application called Auto-Scan. It will run WormScanner in automatic mode in the background, and if WormScanner finds anything, it will ask for your attention. If WormScanner does not find anything noteworthy, it will quit silently. You might want to put Auto-Scan in your Startup Items folder. The first time you run it, it will probably ask you to locate WormScanner for it.
WormScanner is copyrighted freeware, and may be distributed freely as long as it is unaltered. Updates, if any, may be found at the author’s home page: <http://members.aol.com/jwwalker/>.
WormScanner requires Color QuickDraw, meaning that it will not run on machines that use the original 68000 processor. However, the known autostart worms are said to only affect PowerPC Macintoshes, so this limitation should not be a big problem.
Version 2.0.1 changes:
• Fixed a bug that caused crashes on systems earlier than Mac OS 8.
Version 2.0 changes:
• Completely rewritten using CodeWarrior and PowerPlant.
• Preference for Interactive, Automatic, or Passive mode.
• The transcript can be saved as a text file.
• Scans can be controlled with AppleScript.
• When WormScanner finds a worm extension that is actually running as an application, it will try telling the extension to quit.
Version 1.0.1 changes:
• When a file cannot be deleted, WormScanner attempts to make it visible and move it to the trash.
• When running on a Japanese system, the transcript text will be in the Osaka font rather than Geneva, for proper display of Japanese file and folder names.
• When there is an application that has the name of a known worm at root level of one of the disks, but it is not set to auto-start, you will be asked whether to delete it.
• Added a note icon to the alert box that appears when you get a choice of whether to delete something.
