Virus Name: Einstein
V Status: Rare
Discovered: October, 1991
Symptoms: .EXE file growth; TSR
Eff Length: 878 - 892 Bytes
Type Code: PRsE - Parasitic Resident .EXE Infector
Detection Method: ViruScan, AVTK, Sweep, F-Prot, ChAV,
NAV, IBMAV, NAVDX, VAlert, PCScan,
NShld, LProt, Sweep/N, Innoc, NProt, NAV/N,
Removal Instructions: Delete infected files
The Einstein virus was discovered in October, 1991. Its origin is
unknown. Einstein is a memory resident infector of .EXE programs.
When the first Einstein infected program is executed, the Einstein
virus will install itself memory resident as a low system memory
TSR of 1,136 bytes. The virus will hook interrupt 21.
Once the Einstein virus is memory resident, it will infect .EXE
programs when they are executed. Infected programs will have a
file length increase of 878 to 892 bytes. The virus will be
located at the end of the infected file. There will be no change
to the file's date and time in a DOS disk directory listing.
Two text strings can be found within the viral code in Einstein
It is unknown what Einstein does besides replicate, or its