It is not a dangerous memory resident parasitic polymorphic virus. It writes itself to the end of COM and EXE files and uses several level of encryption in infected files and its TSR copy. On July 12th the virus displays an image of a palm and the text: "ANTI-ETA". The virus also contains the text:
<< ANTI-ETA ViRuS Bio.Coded By GriYo / 29A >>
When an infected file is executed, the virus hooks INT 21h and stays memory resident. It then intercepts file execution and opening, stores their names and infects them when they are closed or program is terminated. The virus checks the file names and does not infect TBAV, SCAN, WIN and COMMAND.COM. On changing current directory the virus depending on its random counter drops a random named infected COM file. The virus also deletes the anti-virus data files, if they exist: ANTI-VIR.DAT, CHKLIST.MS.
