B10) Miscellaneous Jargon and Abbreviations

BSI = Boot Sector Infector: a virus which takes control when the
 computer attempts to boot (as opposed to a file infector).

CMOS = Complementary Metal Oxide Semiconductor: A memory area that is
 used in AT and higher class PCs for storage of system information.
 CMOS is battery backed RAM (see below), originally used to maintain
 date and time information while the PC was turned off.  CMOS memory
 is not in the normal CPU address space and cannot be executed.  While
 a virus may place data in the CMOS or may corrupt it, a virus cannot
 hide there.

DOS = Disk Operating System.  We use the term "DOS" to mean any of the
 MS-DOS, PC-DOS, or DR DOS systems for PCs and compatibles, even
 though there are operating systems called "DOS" on other (unrelated)
 machines.

MBR = Master Boot Record: the first Absolute sector (track 0, head 0,
 sector 1) on a PC hard disk, that usually contains the partition table
 (but on some PCs may simply contain a boot sector).  This is not the
 same as the first DOS sector (Logical sector 0).

RAM = Random Access Memory: the place programs are loaded into in
 order to execute; the significance for viruses is that, to be active,
 they must grab some of this for themselves.  However, some virus
 scanners may declare that a virus is active simply when it is found
 in RAM, even though it might be simply left over in a buffer area of
 RAM rather than truly being active.

TOM = Top Of Memory: the end of conventional memory, an architectural
 design limit at the 640K mark on most PCs.  Some early PCs may not
 be fully populated, but the amount of memory is always a multiple of
 64K.  A boot-record virus on a PC typically resides just below this
 mark and changes the value which will be reported for the TOM to the
 location of the beginning of the virus so that it won't get
 overwritten.  Checking this value for changes can help detect a
 virus, but there are also legitimate reasons why it may change (see
 C11).  A very few PCs with unusual memory managers/settings may
 report in excess of 640K.

TSR = Terminate but Stay Resident: these are PC programs that stay in
 memory while you continue to use the computer for other purposes;
 they include pop-up utilities, network software, and the great
 majority of viruses.  These can often be seen using utilities such as
 MEM, MAPMEM, PMAP, F-MMAP and INFOPLUS.


.