It also create a new Local Machine RunServices key named Win32DLL and adds WIN32DLL.VBS as a value to it, so it will run when the system boots, before the user even logs on.

It creates its own key named MSKernel32 under the Local machine registry key that causes programs to run and adds the value MSKERNE元2.VBS to it. When the worm is executed, it copies itself as the files and MSKERNE元2.VBS in the Windows_system_folder and WIN32DLL.VBS in the Windows directory. If the user clicks on 'No', the worm reloads the message in an infinite loop until the user clicks on 'Yes' to allow it to infect the system.

If the user clocks on 'Yes', the worm will infect the system. To work around this, the worm displays a message telling the user to give ActiveX control to the. Internet Explorer security settings do not allow scripts to access disk files and will display a warning when they try to. The worm will be in an infected HTML document named downloaded into the IRC downbloads folder. The worm may also come from an infected computer on the same IRC channel using mIRC. The user must download and execute the worm by clicking on it.

The message body is 'kindly check the attached LOVELETTER coming from me.' The sender line will be the address it was sent from. The virus arrives in an email with the subject line of 'ILOVEYOU' with an attachment '' that people were encouraged to open.

I love you virus download