On execution, the script displays a message explaining that it will calculate the sum of the ASCII values of the characters entered, the idea being that the user enters their name to see if it adds up to 666 (hence the name TripleSix).
It then creates a text input prompt, and when OK is pressed it will act as described:
If the user cancels or does not enter any text, the worm will stop asking for input and begin to replicate itself. Using PKZIP, it will create a zipped copy of itself by the name "666TEST.ZIP" in the Windows directory. It then drops a second file, "REGSVR.VBS", in the System directory and sets it to run on startup.
The worm will then scan for IRC clients in the following directories:
\MIRC \MIRC32 \PIRCH \PIRCH98
Upon finding mIRC, Pirch, or Pirch98 in one of these directories, it will modify the client's setup files to send 666TEST.ZIP to anybody who joins the same IRC channel as the infected user. If run on the fifth of any month, the script will also drop a picture of Milhouse van Houten from The Simpsons as "VANHOUTEN.BMP" and set it as the user's wallpaper.
The first time it is run, the script will also mass-mail 666TEST.ZIP using Microsoft Outlook. The subject line of the message is "666 test" and the message body is:
"> Does your name add up to 666 in ASCII characters? Are you going to go to hell?"
After mass-mailing, the worm sets the following registry key to ensure that it will not mail itself again on subsequent startups.
"HKEY_LOCAL_MACHINE\Software\MIRC/OUTLOOK/PIRCH.VanHouten\" = "True"