Again, unfortunately even though .EXE files have provision for such a value in the file header, no use is made of it. First any attempt to write to an executable file should be viewed with question. Again fortunately, this is not important if the virus is not memory resident. This allocation is detectable. The method used by the author is to make the INT 12h call, shift the value left six times to convert the number of kilobytes to number of segments and store it.
Any mismatch is cause for concern.
Of course this presupposes two things. Since this is run on every boot of a machine and the memory is most stable immediately following a boot, the expected values are stable. To the technician, eventually a feel for the numbers becomes commonplace. If a virus is found, the size of the discrepancy and the type is a good indication of what it is. For example, discovery of a 1792 byte unnamed TSR in low memory immediately suggests a Jerusalem infection.