Karin Virus

 Virus Name:  Karin 
 Aliases:     RedStar 
 V Status:    Rare 
 Discovered:  November, 1991 
 Symptoms:    .COM file growth; message 
 Origin:      Germany 
 Eff Length:  1,090 or 1,134 Bytes 
 Type Code:   PNCK - Parasitic Non-Resident .COM Infector 
 Detection Method:  ViruScan, AVTK, Sweep, F-Prot, PCScan, 
                    NAV, IBMAV, NAVDX, VAlert, ChAV, 
                    NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, 
                    NAV/N, IBMAV/N 
 Removal Instructions:  Delete infected files 
 General Comments: 
       The Karin, or RedStar, virus was received in November, 1991.  This 
       virus is from Germany.  Karin is a non-resident, direct action 
       infector of .COM programs, including COMMAND.COM. 
       When a Karin infected program is executed, the Karin virus will 
       search the current directory for an uninfected .COM program.  If one 
       is found, the virus will infect it.  If COMMAND.COM is located 
       in the current directory, it may become infected as a result. 
       Programs infected with the Karin virus will have a file length 
       increase of either 1,090 or 1,134 bytes.  In either case, the virus 
       will be located at the beginning of the infected file.  There 
       will be no change to the file's date and time in a DOS disk 
       directory listing. 
       The following text strings can be found within the viral code of 
       infected programs: 
               "!Bad copy" 
       The Karin virus activates on October 23rd.  On this date, when an 
       infected program is run the virus will display the following message 
               "Karin hat GEBURTSTAG" 
       This message roughly translates to "Karin's Birthday".  The virus 
       will be stuck in a program loop during the display, and the system 
       will need to be rebooted to end the display.  Booting from an 
       infected copy of COMMAND.COM will result in the display occurring 
       and the system boot failing to proceed. 

Show viruses from discovered during that infect .

Main Page