Patient Virus

Virus Name: Patient Aliases: PK V Status: Rare Discovered: February, 1991 Symptoms: .COM & .EXE growth; TSR; system hangs Origin: United States Eff Length: 1,504 - 1,519 Bytes Type Code: PRsA - Parasitic Resident .COM & .EXE Infector Detection Method: ViruScan, F-Prot, Sweep, AVTK, NAV, IBMAV, NAVDX, VAlert, PCScan, ChAV, NShld, Sweep/N, Innoc, NProt, AVTK/N, IBMAV/N, LProt, NAV/N Removal Instructions: Delete infected files General Comments: The Patient, or PK, virus was discovered in the United States in February, 1991. It was submitted by John McAfee. Patient is a memory resident .COM and .EXE infector. It does not infect COMMAND.COM. Patient is named for its unusual behavior regarding when it will start to replicate. The first time a program infected with Patient is executed, Patient will install itself memory resident as a low system memory TSR of 1,920 bytes. Interrupts 08, 21, 24, and 67 will be hooked by the virus. Once Patient is memory resident, it will not start to spread or replicate to other programs for 20 minutes. After being resident for a minimum of 20 minutes, it will infect .COM and .EXE programs over approximately 2K in size when they are executed. Infected .COM and .EXE programs will increase in size by 1,504 to 1,519 bytes with the virus being located at the end of the infected file. There will be no change in the file's date and time in the DOS disk directory. Patient will sometimes hang the system when it infects programs. Later, when these programs are executed, they may also hang the system. Patient is an encrypted virus, and there are no text strings visible within the viral code in infected programs.