Patient Virus

 Virus Name:  Patient 
 Aliases:     PK 
 V Status:    Rare 
 Discovered:  February, 1991 
 Symptoms:    .COM & .EXE growth; TSR; system hangs 
 Origin:      United States 
 Eff Length:  1,504 - 1,519 Bytes 
 Type Code:   PRsA - Parasitic Resident .COM & .EXE Infector 
 Detection Method:  ViruScan, F-Prot, Sweep, AVTK, NAV, 
                    IBMAV, NAVDX, VAlert, PCScan, ChAV, 
                    NShld, Sweep/N, Innoc, NProt, AVTK/N, IBMAV/N, 
                    LProt, NAV/N 
 Removal Instructions:  Delete infected files 
 General Comments: 
       The Patient, or PK, virus was discovered in the United States in 
       February, 1991.  It was submitted by John McAfee.  Patient is a 
       memory resident .COM and .EXE infector.  It does not infect 
       COMMAND.COM.  Patient is named for its unusual behavior regarding 
       when it will start to replicate. 
       The first time a program infected with Patient is executed, Patient 
       will install itself memory resident as a low system memory TSR of 
       1,920 bytes.  Interrupts 08, 21, 24, and 67 will be hooked by the 
       Once Patient is memory resident, it will not start to spread or 
       replicate to other programs for 20 minutes.  After being resident 
       for a minimum of 20 minutes, it will infect .COM and .EXE programs 
       over approximately 2K in size when they are executed.  Infected 
       .COM and .EXE programs will increase in size by 1,504 to 1,519 
       bytes with the virus being located at the end of the infected file. 
       There will be no change in the file's date and time in the DOS 
       disk directory. 
       Patient will sometimes hang the system when it infects programs. 
       Later, when these programs are executed, they may also hang the 
       Patient is an encrypted virus, and there are no text strings visible 
       within the viral code in infected programs. 

Show viruses from discovered during that infect .

Main Page