Virus Name: Catman
V Status: Rare
Discovery: July, 1991
Symptoms: BSC; Master Boot Sector altered; decrease in total system and
available free memory
Eff Length: N/A
Type Code: BRtX - Resident Boot Sector & Master Boot Sector Infector
Detection Method: NAV, AVTK, F-Prot, Sweep, NAVDX, VAlert,
ViruScan, PCScan, ChAV,
LProt, Sweep/N, AVTK/N, NAV/N, NProt, NShld
Removal Instructions: See Below
The Catman virus was received in July, 1991. Previously, two other
samples of this virus have been received, though they were not
viable viruses. Catman is originally from the USSR. It is a memory
resident infector of diskette boot sectors and the hard disk
master boot sector (partition table).
The Catman virus was submitted in the form of a "dropper" program.
If the dropper program is executed on a diskette drive, the boot
sector of the diskette will become infected with Catman. The
original boot sector will be located at sector 71. If sector 71
was part of file, the file will be corrupted. The remainder of the
virus will be placed in the second sector of the first and second
file allocation table on the disk.
If the Catman dropper was executed on the system hard disk, the virus
will copy the original master boot sector to sector 71, which is part
of the second copy of the file allocation table.
Catman does not replicate from the diskette boot sectors or the
hard disk master boot sector. The only way it can spread, at least
in its present form, is by executing the dropper program.
When a computer system is booted from a diskette infected with the
Catman virus, the boot will usually result in a system hang.
Likewise, booting from the system hard disk with an infected master
boot sector will also result in a system hang.
Catman can be removed from the hard disk master boot sector by
copying back the original master boot sector located at sector 71 to
side 0, cyl 0, sector 1. For system diskettes, the DOS SYS command
can be used to replace the boot sector. Non-system diskettes should
be disinfected by copying all files using the DOS COPY command, and
then reformatting the disk. In any even, programs and files which
were damaged due to the overwritten sectors will not be able to be
recovered, and should be replaced from backup copies.