memory resident virus

[LaVonne Perry [Symantec]]

On 28 Sep 1998 13:20:16 GMT, Stuart Bernstein <xstbe...@vt.edu>
wrote:

>We did a fdisk mbr and cleared the non volatile ram. We also checked
>the free memory (if I remember correctly) and found it only had +/-
>680,000 bytes, which seemed to indicate to the techie there was a
>virus present.

Hi Stuart,

Thanks for visiting the Norton AntiVirus Online Support area.

Actually, having less than 640K or 655,360 bytes is completely normal
for some systems.

The truth is, there are many things besides viruses that can cause
memory to be less than 640K or 655,360 bytes. Here's a short list:

Drive overlay software - OnTrack Disk Manager or EZ Drive for example
Bios
Scanners
Monitor drivers
Other hardware drivers

Each of these can take a small chunk of memory when they load. So
while it's possible that a virus is responsible for less than 640K,
there are many other legitimate reasons for memory to be less than
that. It's really not a very accurate indicator and is simply not
something that we rely upon when determining whether or not a system
is infected.

If you suspect that you have a virus that NAV is unable to detect,
then the best thing to do would be to get a sample into our lab. The
instructions for sample submissions can be found in your User's Guide,
or at our web site,

http://www.symantec.com/avcenter/submit.html

Please let me know if you have any other questions or concerns.

Thanks for writing,

LaVonne Perry
Senior Support Analyst
Symantec Corporation

Please continue to post your messages to the public discussion group as
Symantec does not provide support via private e-mail. Thank you.

If you have difficulty getting a response, please read the following article:

http://service1.symantec.com/SUPPORT/sharedtech.nsf/docid/1998527114414

For free technical support newsletters, Knowledge Base support articles, our Online Support Genie, and FAQs, visit our Norton AntiVirus support page:

http://www.symantec.com/techsupp/nav.html

Personalize your technical support pages at:

http://www.symantec.com/techsupp/custom/custom.cgi