Can a virus hide in Upper Memory or in High Memory?
Yes, it is possible to construct a virus which will locate itself in Upper Memory (640K to 1024K) or in High Memory (1024K to 1088K), and a few currently known viruses (e.g. EDV) do hide in Upper Memory. It might be thought that there is no point in scanning in these areas for any viruses other than those which are specifically known to inhabit them. However, there are cases when even ordinary viruses can be found in Upper Memory. Suppose that a conventional memory-resident virus infects a TSR program and this program is loaded high by the user (for instance, from AUTOEXEC.BAT). Then the virus code will also reside in Upper Memory. Therefore, an effective scanner must be able to scan this part of memory for viruses too.
