[comp.virus] Non-Virus in Shadow Ram

padgett%tccslr.dnet@uvs1.orl.mmc.com (Padgett Peterson) (08/31/90)

	Last night I started receiving alarming messages form my home
PC. Messages like "CANNOT LOAD COMMAND.COM" & "GENERAL FAILURE ERROR"
(on the hard drive) plus boot failures and CMOS trashing. The odd
thing was that if I booted from floppy everything was fine & Norton
reported everything allright.

	Applying Occam's Razor, I removed the LOADHI.SYS from the 10k
trackball driver just added the day before and let it load low. Having
noted some erratic behaviour from things loaded into high memory
before (applications failing strangely, odd display action), this was
my first thought.

	Apparently my high memory manager (QEMM 5.0) has some problems
deciding what high memory is actually unused. In this case, I suspect
that the T'ball driver's buffer was overlaying part of the hard disk
controller (In shadow ram & evidently mutable). But then, if my high
memory were not already overloaded with video, Bernoulli, anti-virus,
print, disk-cache, and keyboard utilities already, I would not have a
problem. Now if I can just figure out DesqView...

	Meanwhile, I have not had time to make a detailed analysis of
just what happened but have noticed a few threads mentioning the same
sort of behaviour & suspect that since my machine has an AMI BIOS with
C&T chipset, it is probably the rule rather than the exception.

	Two factors stand out: the potential for accidental misuse of
high memory could have drastic consequences (consider such an
happening during DEFRAG operations) & for an "at risk" machine, the
performance gain from shadowing must be weighed against the potential
for malicious damage.

	Of course if the vendors would just get their act together &
produce machine speed BIOS (wiring, NOT the fact that it is in ROM)
like they have in upscale video cards the answer would be simple -
except we probably would not pay for it. Oh, Well.
						Padgett