The virus actively hides. Encrypted Direct acting. Overwrites sectors on the Hard Disk. This virus also uses stealth techniques to hide its existance in memory.
Initial infection occurs when a file with an infected directory is executed.
It then infects all .EXE and .COM file directory entries by scrambling the original cluster pointer, placing it in an unused section of the directory structure, and replacing the cluster with a pointer to the virus. An indication of infection is a report of many cross-linked files and lost file chains. If the size of executible files changes between the two, it is fairly certain the virus is present. If you don't get an error message, it is a sign of infection. Format a new diskette and look at its map with PC Tools.