Karin Virus

Virus Name: Karin Aliases: RedStar V Status: Rare Discovered: November, 1991 Symptoms: .COM file growth; message Origin: Germany Eff Length: 1,090 or 1,134 Bytes Type Code: PNCK - Parasitic Non-Resident .COM Infector Detection Method: ViruScan, AVTK, Sweep, F-Prot, PCScan, NAV, IBMAV, NAVDX, VAlert, ChAV, NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, NAV/N, IBMAV/N Removal Instructions: Delete infected files General Comments: The Karin, or RedStar, virus was received in November, 1991. This virus is from Germany. Karin is a non-resident, direct action infector of .COM programs, including COMMAND.COM. When a Karin infected program is executed, the Karin virus will search the current directory for an uninfected .COM program. If one is found, the virus will infect it. If COMMAND.COM is located in the current directory, it may become infected as a result. Programs infected with the Karin virus will have a file length increase of either 1,090 or 1,134 bytes. In either case, the virus will be located at the beginning of the infected file. There will be no change to the file's date and time in a DOS disk directory listing. The following text strings can be found within the viral code of infected programs: "REDSTAR" "*.COM" "!Bad copy" The Karin virus activates on October 23rd. On this date, when an infected program is run the virus will display the following message repeatedly: "Karin hat GEBURTSTAG" This message roughly translates to "Karin's Birthday". The virus will be stuck in a program loop during the display, and the system will need to be rebooted to end the display. Booting from an infected copy of COMMAND.COM will result in the display occurring and the system boot failing to proceed.