If you don't know anything about direct memory allocation, Memory Control
Blocks (MCB) and Terminate and Stay Resident programming, then this article
might be a bit too advanced for you.

  MCB Stealth is used to hide the allocated memory, by releasing the
memory before a known memory diagnostic program is executed. When the
program exits, the newly released memory gets allocated once again.

  When a program is executed (function 4B00h), the procedure is as follows:
    1. Check if the executed program is a known memory diagnostic program.
    2. Find the last Memory Control Block (MCB) in chain.
    3. Free the previously allocated memory.

  When a program exits (function 4Ch and 31h), the procedure is as follows:
    1. Check if the memory is released.
    2. Find the last Memory Control Block (MCB) in chain.
    3. Allocate the newly freed memory.

I would like to thank Clive Sharp for helping me with the English.

---------------------------------------------------------------------
Checking if the executed program is a known memory diagnostic program
---------------------------------------------------------------------

  There are quite a few ways to check if an executed program is a known memory
diagnostic program, but I've used the following way:

  First I open the file, then I get the system File Control Block (FCB) from
the System File Table (function 1220h and 1216h) and then I close the file.
Then I compare the filename (offset 20h) from the system File Control
Block (FCB) against my list of filenames of known memory diagnostic programs.

  These files are known memory diagnostic programs:
    CHKDSK.EXE  DOS Chkdsk
    MEM.EXE     DOS Mem
    MFT.EXE     Quarterdeck Manifest

-------------------------------------------------
Find the last Memory Control Block (MCB) in chain
-------------------------------------------------

  If a known memory diagnostic program is being executed, then I get the
segment of the first Memory Control Block (MCB) in the chain from Get list of
lists (function 52h), offset -02h. The following is the description of the
Memory Control Block (MCB):

 ----------------------------------------------------------------------------
 Offset  Size    Description
 ----------------------------------------------------------------------------
   00h     1     Block type: 5Ah if last block in chain, otherwise 4Dh
   01h     2     PSP segment of owner, 0000h if free, 0008h if belongs to DOS
   03h     2     Size of memory block in paragraphs
 ----------------------------------------------------------------------------

  To find the segment of the last Memory Control Block (MCB) in the chain, I
add the size of memory block in paragraphs (offset 03h) to the current Memory
Control Block (MCB) and increase that by one, then I have the new Memory
Control Block (MCB). Then I determine the block type, to see if the new Memory
Control Block (MCB) is the last in chain, if it isn't I will continue the
process until I find the last Memory Control Block (MCB) in chain.

------------------------------------
Free the previously allocated memory
------------------------------------

  To free the previously allocated memory, I add the size of the previously
allocated memory from the size of memory block in paragraphs (offset 03h) and
then I execute the actual program.

-------------------------------
Check if the memory is released
-------------------------------

  There are quite a few ways to check if the memory is released, I use a
boolean variable, which tells me if the newly released memory has to be
allocated once again. If I have to allocate the newly released memory once
again I find the last Memory Control Block (MCB) in chain, as described above.

-------------------------------
Allocate the newly freed memory
-------------------------------

  To allocate the newly released memory, I subtract the size of the newly
released memory from the size of memory block in paragraphs (offset 03h) and
then I exit the current program.

---------------------
Final tips and tricks
---------------------

  - You could make sure that the executed memory diagnostic program doesn't
    allocate your virus memory, but I don't find that necessary, because there
    is hardly any chance of that happening.
  - You could create a Memory Control Block (MCB) in front of your virus and
    just modify the PSP segment owner (offset 01h).