Einstein Virus

Virus Name: Einstein Aliases: V Status: Rare Discovered: October, 1991 Symptoms: .EXE file growth; TSR Origin: Unknown Eff Length: 878 - 892 Bytes Type Code: PRsE - Parasitic Resident .EXE Infector Detection Method: ViruScan, AVTK, Sweep, F-Prot, ChAV, NAV, IBMAV, NAVDX, VAlert, PCScan, NShld, LProt, Sweep/N, Innoc, NProt, NAV/N, AVTK/N, IBMAV/N Removal Instructions: Delete infected files General Comments: The Einstein virus was discovered in October, 1991. Its origin is unknown. Einstein is a memory resident infector of .EXE programs. When the first Einstein infected program is executed, the Einstein virus will install itself memory resident as a low system memory TSR of 1,136 bytes. The virus will hook interrupt 21. Once the Einstein virus is memory resident, it will infect .EXE programs when they are executed. Infected programs will have a file length increase of 878 to 892 bytes. The virus will be located at the end of the infected file. There will be no change to the file's date and time in a DOS disk directory listing. Two text strings can be found within the viral code in Einstein infected programs: "exeEXE" "Einstein" It is unknown what Einstein does besides replicate, or its damage potential.