Abstract: The methods and systems described herein provide for the detection of a software worm in a computer network, such as the Internet, and/or a limitation of the rate of infection of a software worm within a computer network. In a preferred embodiment, a worm detector software module observes the behavior of, and optionally inspects the electronic messages sent from, a particular computer system, network address, virtual machine, and/or cluster. A worm screen software program edits the flow of traffic from the network address when a possibility of a worm infection achieves a certain level. This editing may include the discarding or rerouting for storage or analysis of messages prepared for transmission by a particular computer system, network address, virtual machine, and/or cluster monitored by the worm screen. The worm screen may be co-located with the worm detector, or comprised within a same software program.