Patent ID: 7810158

Claim:
A method of trapping electronic worms, the method comprising: detecting an electronic worm in an infected computer; comprising examining outbound network communications from the computer to identify a non-spoofed probe being sent by the electronic worm to one or more target computers; trapping the electronic worm, comprising at least one of the following: blocking further outbound non-spoofed probing by the electronic worm; blocking inbound replies to previously sent outbound non-spoofed probes; blocking efforts by the electronic worm to perform an initial intrusion into vulnerable target computers; blocking efforts by the electronic worm to transfer itself to the target computers; forwarding the identified non-spoofed probe to a deceptive-responder that is remote from the infected computer and the target computers; and communicating with the trapped electronic worm via the deceptive responder, comprising sending the electronic worm a mimicked response to the non-spoofed probe in a format that the electronic worm is expecting to receive.