Presence of registry key:
HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun or RunOnce
with a value formed with the folowing words:
pointing to a file in Windows Directory whose name is formed with the above words too, and the presence of that file.
The worm comes by mail in the following form, in German or English language:
Microsoft Alert: Please Read!
Microsoft Alarm: Bitte Lesen!”