DOCUMENT:Q72364 17-DEC-2000 [msdos] TITLE :Virus Reduces Total Conventional Memory PRODUCT :Microsoft Disk Operating System PROD/VER:MS-DOS:3.x,4.x,5.x,6.0,6.2,6.21,6.22 OPER/SYS: KEYWORDS: ====================================================================== ------------------------------------------------------------------------------- The information in this article applies to: - Microsoft MS-DOS operating system versions 3.1, 3.2, 3.21, 3.3, 3.3a, 4.0, 4.01, 5.0, 5.0a, 6.0, 6.2, 6.21, 6.22 ------------------------------------------------------------------------------- SUMMARY ======= Systems infected by some computer viruses will indicate conventional memory stops at 638K rather than 640K. This can cause problems with applications that check for the presence of a full 640K of conventional memory before loading. Many of the customers reporting this problem have noted that after booting from the hard drive, programs like CHKDSK indicate total conventional memory is 638K, but after booting from the floppy disk drive, CHKDSK indicates 640K total conventional memory. (This will not always be the case, because the bootable floppy disk might also be infected by the virus.) In both cases, the Power On Self Test (POST) counts 640K of conventional memory during the memory test. MORE INFORMATION ================ When some computer viruses install, they become "memory resident" by decrementing the BIOS data area's "base memory size in K" field (address 00413H) by 2K and then loading into the upper 2K of conventional memory. As a result, programs that determine the base memory size via BIOS interrupt 12H (or by directly reading the contents of 00413H) will report less conventional memory than is actually installed in the system. An example of such a virus is the "Stoned" virus and its various strains ("Stoned-II," "Stoned-A," and so forth). Performing a low-level format on infected hard drives is one technique for eliminating these viruses. (Warning: The low-level format will erase ALL data contained on your hard drive.) There are also commercially available "vaccine" programs that can detect and remove viruses without erasing other data contained on your disk. If you suspect that your computer has a virus and you are using MS-DOS 6.0 or later, run Microsoft Anti-Virus. If you are running an earlier version of MS-DOS, either obtain MS-DOS 6.0 or later, or obtain help from a third- party virus-correction service or vendor. NOTE: Some computer systems (primarily PS/2-type systems with the MicroChannel Architecture [MCA]) allocate 2K of conventional memory to the extended BIOS data area. On these systems, a reduction in conventional memory is probably not due to the presence of a computer virus. For more information on the extended BIOS data area query on the following words: " extended and bios and data and area and mem " (without the quotation marks) Additional query words: 6.22 3.20 3.21 3.30 3.30a 4.00 4.01 5.00 5.00a 6.00 6.20 6.21 ====================================================================== Keywords : Technology : kbMSDOSSearch kbMSDOS321 kbMSDOS400 kbMSDOS320 kbMSDOS330a kbMSDOS621 kbMSDOS622 kbMSDOS620 kbMSDOS600 kbMSDOS310 kbMSDOS500 kbMSDOS330 kbMSDOS401 kbMSDOS500a Version : MS-DOS:3.x,4.x,5.x,6.0,6.2,6.21,6.22 ============================================================================= THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. MICROSOFT DISCLAIMS ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. IN NO EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. SOME STATES DO NOT ALLOW THE EXCLUSION OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES SO THE FOREGOING LIMITATION MAY NOT APPLY. Copyright Microsoft Corporation 2000.