Scott's Valley (computer virus)

Computer virus | Fullname = Scott's Valley
Common name = Scott's Valley
Technical name = Scott's Valley
Family = Slow
Aliases = Slow.2131
Classification = Virus
Type = DOS
Subtype = DOS file infector
IsolationDate = September 1990
Isolation = Scotts Valley, California, United States
Origin = Unknown
Author = Unknown

Scott's Valley (sic) is a computer virus, a member of the Slow virus family and distantly related to the Jerusalem virus family. It was discovered in September 1990 in Scotts Valley, California.

It is named after the city of Scotts Valley, although that is spelt without an apostrophe.

Infection

Scott's Valley is a very standard memory resident DOS file infector. Upon execution, it goes memory resident and infects COM and EXE files as they are opened. It does not infect COMMAND.COM. Because Scott's Valley has never been fully analysed, it is unknown whether it also infects OVL files as most Jerusalem variants do.

ymptoms

Scott's Valley is only partially analysed, and as such, this list of symptoms may be incomplete.

*COM files executed will increase by 2,131 bytes in size; EXE files will increase by between 2,131 and 2,140 bytes.
*Interrupt 21 will be hooked.
*Infected files will contain the seemingly meaningless hex string 5E8BDE909081C63200B912082E.

Scott's Valley is a member of the Slow virus family, which has been associated with system slowdowns, although this symptom is unconfirmed. This could stem from the Slow virus' (and thus the Scott's Valley virus') relationship to the Jerusalem virus, which slowed down the system after 30 seconds and displayed a black box in the lower lefthand corner. It is not believed that Scott's Valley exhibits the "black box" behaviour, nor that it carries Jerusalem's destructive payload.

Prevalence

The WildList [http://www.wildlist.org/] , an organisation tracking computer viruses, never reported Scott's Valley as being in the field. Although it was isolated in the field spreading in California, there is no evidence to suggest it ever became common. Like most older, rare DOS viruses, it is probable that Scott's Valley has become extinct, and obsolete at the minimum.

External links

* [http://vil.nai.com/vil/content/v_1062.htm McAfee Description]