System and method for detecting and defending computer worm

This invention relates to test and protective computer ill-purpose program system, which comprises the following parts: computer operation system monitor device to collect aim programs operation information; aim program operation record device to store aim programs operation records and to record repaired files, register form; known action characteristics memory device to store known, processed operation information and to store each operation relative danger degree weigh; aim program action identification analysis device to compare the aim program with known action; ill-purpose action removal device to remove the ill-purpose program.