Virus Name: Patient
V Status: Rare
Discovered: February, 1991
Symptoms: .COM & .EXE growth; TSR; system hangs
Origin: United States
Eff Length: 1,504 - 1,519 Bytes
Type Code: PRsA - Parasitic Resident .COM & .EXE Infector
Detection Method: ViruScan, F-Prot, Sweep, AVTK, NAV,
IBMAV, NAVDX, VAlert, PCScan, ChAV,
NShld, Sweep/N, Innoc, NProt, AVTK/N, IBMAV/N,
Removal Instructions: Delete infected files
The Patient, or PK, virus was discovered in the United States in
February, 1991. It was submitted by John McAfee. Patient is a
memory resident .COM and .EXE infector. It does not infect
COMMAND.COM. Patient is named for its unusual behavior regarding
when it will start to replicate.
The first time a program infected with Patient is executed, Patient
will install itself memory resident as a low system memory TSR of
1,920 bytes. Interrupts 08, 21, 24, and 67 will be hooked by the
Once Patient is memory resident, it will not start to spread or
replicate to other programs for 20 minutes. After being resident
for a minimum of 20 minutes, it will infect .COM and .EXE programs
over approximately 2K in size when they are executed. Infected
.COM and .EXE programs will increase in size by 1,504 to 1,519
bytes with the virus being located at the end of the infected file.
There will be no change in the file's date and time in the DOS
Patient will sometimes hang the system when it infects programs.
Later, when these programs are executed, they may also hang the
Patient is an encrypted virus, and there are no text strings visible
within the viral code in infected programs.