Virus Name: Karin
V Status: Rare
Discovered: November, 1991
Symptoms: .COM file growth; message
Eff Length: 1,090 or 1,134 Bytes
Type Code: PNCK - Parasitic Non-Resident .COM Infector
Detection Method: ViruScan, AVTK, Sweep, F-Prot, PCScan,
NAV, IBMAV, NAVDX, VAlert, ChAV,
NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N,
Removal Instructions: Delete infected files
The Karin, or RedStar, virus was received in November, 1991. This
virus is from Germany. Karin is a non-resident, direct action
infector of .COM programs, including COMMAND.COM.
When a Karin infected program is executed, the Karin virus will
search the current directory for an uninfected .COM program. If one
is found, the virus will infect it. If COMMAND.COM is located
in the current directory, it may become infected as a result.
Programs infected with the Karin virus will have a file length
increase of either 1,090 or 1,134 bytes. In either case, the virus
will be located at the beginning of the infected file. There
will be no change to the file's date and time in a DOS disk
The following text strings can be found within the viral code of
The Karin virus activates on October 23rd. On this date, when an
infected program is run the virus will display the following message
"Karin hat GEBURTSTAG"
This message roughly translates to "Karin's Birthday". The virus
will be stuck in a program loop during the display, and the system
will need to be rebooted to end the display. Booting from an
infected copy of COMMAND.COM will result in the display occurring
and the system boot failing to proceed.