This virus collects user information and add a log at the end of the virus body. The code is changed for every infection and the virus keeps on adding a log of the users.
    It checks for infection by searching for the marker "<- this is a marker!" that it inserts in an infected file. If the marker does not exist, it will infect the file.
    This will create two files in the root directory of drive C. The first file c:\hsfXXXX.sys, where XXXX are random numbers, is used to store the virus code and the information log.
    The second file is c:\netldx.vxd, which is used as a script which contains ftp commands for uploading the logfile codebreakers.org ftp site.
    The uploading happens when the virus activates in the first day of the month and if the following registry key is false:
"HKEY_CURRENT_USER\Software\Microsoft\MS Setup (ACME)\User Info"