It infects the master boot record of the hard disk and executables. It ignores files that their filename contain any of the following strings: SCAN CLEAN FINDVIRU GUARD NOD VSAFE MSAV CHKDSK After the installation of the virus, every time the user boots or reboots the computer, the virus loads and encrypts last 2 unencrypted cylinders. The encryption is done by bitwise XOR operation by a randomly generated key, which the decryption is to perform the same operation with same key again. On access of these encrypted cylinders the virus decrypts them, so that the user might not notice.