Re: Is this a virus? (PC)

Article View: comp.virus

Article #4200

#4200

From: Paul Ducklin
Date: Fri, 13 Nov 1992 16:20

20 lines
1405 bytes

Thus spake rknazik@x102a.harris-atd.com (knazik bob):
>My 386 PC reports that I have 654360 conventional memory when I do a
>"chkdsk" or a "mem" (DOS 5.0).  This is 1024 short of the expected
>amount.  I seem to remember that there was a virus that caused this
>result, but VSCAN finds nothing wrong.  Does anyone know if this is a
>virus or just some weird hardware failure ?  Any help is appreciated.

Some BIOSes use the top 1KB of the DOS 640KB area as an extension to
the BIOS data area at 0040:0000, so 1KB missing at the top of DOS
memory might be quite normal.

Boot clean and then try MEM. The figure you see reported after a clean
boot is the "normal" figure for your PC. If you boot from hard disc and
see less than "normal", you may then get worried..

- -- 
- --..--..--..--..--..--..--..--..--..--..--..--..--..--..--..--..--..--..--
Paul Ducklin                                       duck@nuustak.csir.co.za

  CSIR Computer Virus Research Lab * Box 395 * Pretoria * 0001 S Africa

Technical Details

Message-ID: <0001.9211161950.AA15221@barnabas.cert.org>

Path:

arc1-ca.pugleaf.net!sparky!uunet!charon.amdahl.com!pacbell.com!ames!sun-barr!rutgers!netnews.upenn.edu!netnews.cc.lehigh.edu!news

Show Full Headers

Complete Article Headers

Path: arc1-ca.pugleaf.net!sparky!uunet!charon.amdahl.com!pacbell.com!ames!sun-barr!rutgers!netnews.upenn.edu!netnews.cc.lehigh.edu!news
From: duck@nuustak.csir.co.za (Paul Ducklin)
Newsgroups: comp.virus
Subject: Re: Is this a virus? (PC)
Message-ID: <0001.9211161950.AA15221@barnabas.cert.org>
Date: 13 Nov 92 16:20:38 GMT
Sender: virus-l@lehigh.edu
Lines: 20
Approved: news@netnews.cc.lehigh.edu