We introduce models for cooperative mitigating response strategies to suppress large scale Internet worm attack. In our models, cooperating members communicate with others using a "friend protocol" that spreads attack reports to potentially vulnerable uninfected sites. We use mathematical models for the simplest strategies and a simulation for more complex models of mitigation. We investigate the performance of different strategies both in the presence of large scale worms and of false alarms.