Virus Reduces Total Conventional Memory (72364)


The information in this article applies to:

  • Microsoft MS-DOS operating system 3.1
  • Microsoft MS-DOS operating system 3.2
  • Microsoft MS-DOS operating system 3.21
  • Microsoft MS-DOS operating system 3.3
  • Microsoft MS-DOS operating system 3.3a
  • Microsoft MS-DOS operating system 4.0
  • Microsoft MS-DOS operating system 4.01
  • Microsoft MS-DOS operating system 5.0
  • Microsoft MS-DOS operating system 5.0a
  • Microsoft MS-DOS operating system 6.0
  • Microsoft MS-DOS operating system 6.2
  • Microsoft MS-DOS operating system 6.21
  • Microsoft MS-DOS operating system 6.22
This article was previously published under Q72364

SUMMARY

Systems infected by some computer viruses will indicate conventional memory stops at 638K rather than 640K. This can cause problems with applications that check for the presence of a full 640K of conventional memory before loading.

Many of the customers reporting this problem have noted that after booting from the hard drive, programs like CHKDSK indicate total conventional memory is 638K, but after booting from the floppy disk drive, CHKDSK indicates 640K total conventional memory. (This will not always be the case, because the bootable floppy disk might also be infected by the virus.) In both cases, the Power On Self Test (POST) counts 640K of conventional memory during the memory test.

MORE INFORMATION

When some computer viruses install, they become "memory resident" by decrementing the BIOS data area's "base memory size in K" field (address 00413H) by 2K and then loading into the upper 2K of conventional memory. As a result, programs that determine the base memory size via BIOS interrupt 12H (or by directly reading the contents of 00413H) will report less conventional memory than is actually installed in the system. An example of such a virus is the "Stoned" virus and its various strains ("Stoned-II," "Stoned-A," and so forth).

Performing a low-level format on infected hard drives is one technique for eliminating these viruses. (Warning: The low-level format will erase ALL data contained on your hard drive.) There are also commercially available "vaccine" programs that can detect and remove viruses without erasing other data contained on your disk.

If you suspect that your computer has a virus and you are using MS-DOS 6.0 or later, run Microsoft Anti-Virus. If you are running an earlier version of MS-DOS, either obtain MS-DOS 6.0 or later, or obtain help from a third- party virus-correction service or vendor. NOTE: Some computer systems (primarily PS/2-type systems with the MicroChannel Architecture [MCA]) allocate 2K of conventional memory to the extended BIOS data area. On these systems, a reduction in conventional memory is probably not due to the presence of a computer virus. For more information on the extended BIOS data area query on the following words:

extended and bios and data and area and mem

Modification Type:MajorLast Reviewed:5/10/2003
Keywords:KB72364
©2002 Microsoft Corporation. All rights reserved.