This program scans your local drives for the AutoStart 9805 worms, variants A through F. It is based on published descriptions of the activities of these worms. It has not been tested on all variants of live worms. At this writing, variants A through F of the worm are known.
Besides the known worms, WormScanner will also tell you about “suspicious” files, namely autostart applications and invisible extensions. Bear in mind that these suspicious files might have been installed by commercial software for innocent purposes, although I personally have difficulty imagining a legitimate purpose for making an extension invisible. I do know of one case in which a demo version of a commercial application installs an invisible extension as part of a copy protection scheme. However, in that case, the extension lacks a resource fork, and therefore will not really run as an extension. WormScanner will not report such fake extensions.
Worms may lurk inside disk image files, but unless the disk image is mounted, WormScanner will not be able to look inside.
Please note that unlike some antivirus programs, WormScanner only scans when you tell it to, by clicking the Scan button or running the Auto-Scan script. If you want each diskette or Zip disk to be scanned whenever it is inserted into the computer, you need some other program.
WormScanner requires Color QuickDraw, meaning that it will not run on machines that use the original 68000 processor. However, the known autostart worms are said to only affect PowerPC Macintoshes, so this limitation should not be a big problem.
Advice
In the QuickTime Settings control panel, you should turn off the option “Enable CD-ROM AutoPlay”. That’s one of the mechanisms that the worm uses to reproduce itself, and is easy to live without.
If you know that you have a worm infection, it would be a good idea to restart with extensions disabled before trying to remove the infection. That way, the worm won’t be trying to do its dirty work while you’re trying to get rid of it.
WormScanner Options
WormScanner can run in three modes: Interactive, Automatic, and Passive. Initially it will be in Interactive mode, but you can change it by choosing the Preferences menu item.
Interactive mode:
• WormScanner will automatically delete known worm files, if possible. If it is not possible to delete the file, then WormScanner will attempt to make it visible and move it to the trash.
• When WormScanner finds a suspicious file (autostart application or invisible extension), WormScanner will ask you whether to delete it or not.
Automatic mode:
• WormScanner will automatically delete known worm files, if possible. If it is not possible to delete the file, then WormScanner will attempt to make it visible and move it to the trash.
• When WormScanner finds a suspicious file (autostart application or invisible extension), WormScanner will note it in the transcript, but do nothing about it.
Passive mode:
• When WormScanner finds a known worm file, WormScanner will note it in the transcript, but do nothing about it.
• When WormScanner finds a suspicious file (autostart application or invisible extension), WormScanner will note it in the transcript, but do nothing about it.
There is also an option for how widely to search:
• In All Folders means that WormScanner will look everywhere that the worm has been known to copy itself. To be explicit, WormScanner looks for the extension form of the worm in all folders named Extensions, and looks for the application form of the worm in all folders. This option is slower.
• Only In Trouble Spots means that only looks in places where the worm can run. To be exact, WormScanner looks for the extension form in each volume’s System Folder and Control Panels and Extensions subfolders, and looks for the application form at the root of each volume. This option is faster, and should suffice to protect you.
Finally, there is an option to scan remote volumes. Most users should not turn on this option. I added it because a few people complained about having no way to remove the worm from Windows NT servers.
I have provided an AppleScript application called Auto-Scan. It will run WormScanner in automatic mode, searching only in trouble spots, in the background. If WormScanner finds anything, it will ask for your attention. If WormScanner does not find anything noteworthy, it will quit silently. You might want to put Auto-Scan in your Startup Items folder. The first time it runs, it will ask you to locate WormScanner. (For technical reasons, it won’t work in your Shutdown Items folder.)
Distribution
WormScanner is copyrighted freeware, and may be distributed freely as long as it is unaltered. That is, you need not ask my permission in order to post it on your web site or include it on a CD-ROM software collection. Updates, if any, may be found at the author’s home page: <http://members.aol.com/jwwalker/>. You can send feedback to me at <mailto:jwwalker@kagi.com>, however I cannot provide individual help with your worm or virus problems.
Change History
Version 2.2.1 changes:
• Fixed a bug that caused version 2.2 to crash if you had a version of QuickTime earlier than 3.0 and had never changed your QuickTime settings.
• If WormScanner put up a dialog asking for permission to delete something, and then fails to delete it, WormScanner will put up an alert saying so.
• If a scan finds nothing of note, it will write “No problems found.” at the end of the transcript.
Version 2.2 changes:
• Added the option to search everywhere or only in trouble spots. Neither of these options is exactly what previous versions were doing. Previously, WormScanner looked in all Extensions folders, but only looked for the application form at volume roots.
• When WormScanner clears the autostart specification on a volume, it fixes the boot blocks so that Norton Disk Doctor won’t say that the boot blocks are damaged.
• WormScanner’s AppleScript dictionary has been changed.
• If CD-ROM autoplay is turned on and this is a PowerMac, WormScanner will warn you to turn the option off.
• Added the option to scan remote volumes.
Version 2.1.1 changes:
• The transcript once again uses the Osaka font when running under a Japanese system. This was broken in version 2.1.
Version 2.1 changes:
• WormScanner now checks System Folders other than the one on the startup disk, and checks Extensions folders other than those inside System Folders.
• Fixed a bug that caused a crash when you ran off a locked startup disk, such as a Mac OS installer CD.
• The format of the transcript is improved.
• Audio CDs are skipped. (Formerly, a scan stopped the music from playing.)
• Text can be dragged out of the window.
• The scan window supports live scrolling.
• The About box shows a version number, gives credit for CWASTEEdit, and shows proper apostrophes and copyright symbols when running on a Japanese system.
• Fixed the Auto-Scan script so that it doesn’t keep asking where WormScanner is.
Version 2.0.1 changes:
• Fixed a bug that caused crashes on systems earlier than Mac OS 8.
Version 2.0 changes:
• Completely rewritten using CodeWarrior and PowerPlant.
• Preference for Interactive, Automatic, or Passive mode.
• The transcript can be saved as a text file.
• Scans can be controlled with AppleScript.
• When WormScanner finds a worm extension that is actually running as an application, it will try telling the extension to quit.
Version 1.0.1 changes:
• When a file cannot be deleted, WormScanner attempts to make it visible and move it to the trash.
• When running on a Japanese system, the transcript text will be in the Osaka font rather than Geneva, for proper display of Japanese file and folder names.
• When there is an application that has the name of a known worm at root level of one of the disks, but it is not set to auto-start, you will be asked whether to delete it.
• Added a note icon to the alert box that appears when you get a choice of whether to delete something.
