[comp.virus] 640k vs 639k

padgett%tccslr.dnet@uvs1.orl.mmc.com (07/18/90)

I have seen this on a number of machines (Compaq particularly) that
reserve 1k of top memory for drivers/etc (Compaq claims it is for its
mouse & can be recovered by moving a jumper on the mother board).
There are a couple of viruses that use this same technique in software
(Brain, Yale) but the reserved area is usually larger than 1k and it
contains executable code. The conflict comes about because some memory
checkers use Int 21 Fn 48 to determine free memory, others use Int 12,
while some just look at 0:413 & 414 for the number of reported
segments. These may report differently. The best tool I have seen for
checking is Quarterdeck's MANIFEST though it can be confused
sometimes. The freeware (?) program MAPMEM by Turbopower Software when
used with the /V (verbose) option is also very good.