Satria Virus
Virus Name: Satria
Aliases: Satria.RZ, ILove (b)
V Status: Common
Discovery: January, 1997
Symptoms: BSC; master boot record on hard disk altered;
message displayed on monitor;
decrease in total system & available free memory
Origin: Unknown
Eff Length: N/A
Type Code: BRtX - Resident Diskette Boot Sector & MBR Infector
Detection Method: NAV, NAVDX, AVTK, ViruScan
Removal Instructions: DOS FDisk /MBR
General Comments:
The Satria or Satria.RZ virus was received in January, 1997. It is
believed to be from the United States. Satria is a memory resident
infector of diskette boot sectors and the system hard disk master
boot record (MBR).
The first time a system is booted from a Satria infected diskette,
the Satria virus will install itself memory resident at the top of
system memory but below the 640K DOS boundary, moving interrupt 12's
return. Total system and available free memory, as indicated by the
DOS CHKDSK program, will have decreased by 1,024 bytes. Also at this
time, the virus will infect the system hard disk master boot record,
enabling the virus to become memory resident whenever the system is
booted from the infected system hard disk.
Once the Satria virus is memory resident, it will infect the boot
sector of any non-write protected diskette accessed on the system.
This virus copies the original boot sector to the last or second
to last sector of the root directory of the diskette, then places a
copy of itself in the boot sector. The following text strings can
be found within the viral code:
"LOVE"
"(c)Satria.RZ"
The following message may be displayed on the system monitor when
the system is booted from an infected diskette or hard drive:
"I