I Love You Worm: what it is and how to remove it

I Love You Worm is a program that was installed on the PC, most likely together with something else you downloaded. Free software sites and many installers add extra programs on setup pages with pre-ticked boxes, so the extra install looks like your choice even though nobody read the page.

Check the install date in Settings, Apps, Installed apps: the program you installed that day is the probable carrier. If you do not need I Love You Worm, uninstall it. If it belongs to your hardware or to a program you use, search its exact name and publisher first, because drivers and their tools can have unfamiliar names.

First restart the PC and try again, because the program may have been running and locked its own files. If the uninstaller is missing or fails, start Windows in Safe Mode, where most third-party programs do not start, and remove I Love You Worm from Installed apps there.

If it still refuses, delete its startup entry and its scheduled task, restart, and try once more. A program that actively prevents removal is behaving like malware, so finish with a Microsoft Defender offline scan. Avoid third-party uninstallers offered on search ads; several of them are unwanted programs themselves.

It is a good idea, even for malware that does not spread by itself. The same download, USB stick or loader may have been used on other PCs in the household, and shared folders can carry files between them.

Run a full scan followed by the Microsoft Defender offline scan on each Windows PC that shared drives or files with the infected one. Do not copy programs or installers from the infected PC until it is clean, and change Wi-Fi and router passwords if they were saved on it.

From the reports we have, I Love You Worm is a worm. The one sign people describe is I Love You Worm in the list of installed apps, and that pattern fits malware that runs hidden on Windows for someone else's benefit.

No sample has been analysed in public yet, so we do not name a family or a coin and we do not guess at extra features. What matters for you is that it is not a Windows component and not something you installed on purpose.

The steps in this guide remove it whatever the details turn out to be: find what starts it, remove that, scan offline and check what may have arrived with it. We update this page when an analysis appears.

There is no evidence either way yet, because I Love You Worm has not been analysed in public. The reported sign, I Love You Worm in the list of installed apps, does not show theft by itself. However, malware of this kind is often installed together with a password stealer, which works in seconds and leaves nothing to see.

The cautious approach costs little: once the PC is clean, change the passwords saved in your browsers from another device, starting with e-mail, then banking and payment accounts. Sign out of all sessions and turn on two-step verification. If a bank card was saved in the browser, ask the bank about a replacement.

Only if the signs point to deeper access. Reset when you see I Love You Worm in the list of installed apps again after removal, when Windows Security cannot start or update, when remote access tools you did not install keep appearing, or when you simply cannot trust the PC any more.

Otherwise, the plan in this guide plus an offline scan is enough. If you do reset, choose Remove everything and Cloud download for a fresh copy of Windows, restore only documents and photos, and reinstall programs from their official sites. Change important passwords from the clean system afterwards.

We cannot name a source for I Love You Worm yet, because no one has traced its distribution in public. In the cases we see, a worm most often comes with pirated software, activators, game mods and cheats, or with downloads from sites that repackage free programs.

Removable drives are another route for self-spreading kinds. Your own history is the best clue: what did you install or plug in shortly before you first noticed I Love You Worm in the list of installed apps? Whatever it was should be removed together with the malware and never reinstalled from the same place.

Restart the PC first; some changes only take effect after a reboot. Then open Task Manager and check the Processes and Startup apps tabs for anything unfamiliar using the processor, disk or network. If something remains, run the Microsoft Defender offline scan once more.

Slowness can also come from a second infection installed alongside I Love You Worm, or from programs that were damaged during the clean-up. If nothing helps, back up your files and reset Windows. Copy only documents and photos before a reset, and scan the copies.

Let Windows Security handle it instead. When it finds I Love You Worm, choose Remove or Quarantine; the scanner also removes related startup entries and tasks that a manual delete would miss. Deleting a running file by hand often fails, and many threats restore themselves from a second copy.

After the removal, run the Microsoft Defender offline scan, which works before Windows starts and catches parts that hide while Windows runs. Then check Task Scheduler for leftovers. Restart afterwards and check that the detection does not return.

Fortect scans Windows for malware and unwanted programs and repairs the system files and settings they change, and its free scan shows what it finds on your PC before you decide anything.

For I Love You Worm, follow the plan above as well: the browser steps take back permissions and settings that no scanner treats as a threat, and uninstalling the program that brought it removes the source.

Run Microsoft Defender's full scan and, if anything was found, its offline scan as a second opinion. If the symptoms are gone after the plan and both scans are clean, there is nothing more to do.