It is not a dangerous memory resident boot virus. It infects the MBR of the hard drive and the boot sector of floppy disks. The MBR gets infection on loading from infected floppy disk, the boot on floppy disks gets infection on accessing the disk.
The virus calls Novell Netware function and creates a supervisor object there with the "ANDRISD" name. This object then might be used to login illegal user with supervisor privileges. This object is also invisible for non-supervisor users.
