Scott's Valley (computer virus)
Encyclopedia
is a computer virus
Computer virus
A computer virus is a computer program that can replicate itself and spread from one computer to another. The term "virus" is also commonly but erroneously used to refer to other types of malware, including but not limited to adware and spyware programs that do not have the reproductive ability...

, a member of the Slow virus family and distantly related to the Jerusalem virus family. It was discovered in September 1990 in Scotts Valley, California
Scotts Valley, California
Scotts Valley is a small city in Santa Cruz County, California, United States, about thirty miles south of downtown San Jose and six miles north of Monterey Bay, in the upland slope of the Santa Cruz Mountains. As of the 2010 census, the city population was 11,580...

.

It is named after the city of Scotts Valley, although that is spelled without an apostrophe
Apostrophe
The apostrophe is a punctuation mark, and sometimes a diacritic mark, in languages that use the Latin alphabet or certain other alphabets...

.

Infection

Scott's Valley is a very standard memory resident DOS file infector. Upon execution, it goes memory resident and infects COM
COM file
In many computer operating systems, a COM file is a type of executable file; the name is derived from the file name extension .COM. Originally, the term stood for "Command file", a text file containing commands to be issued to the operating system , on many of the Digital Equipment Corporation mini...

 and EXE
EXE
EXE is the common filename extension denoting an executable file in the DOS, OpenVMS, Microsoft Windows, Symbian, and OS/2 operating systems....

 files as they are opened. It does not infect COMMAND.COM
COMMAND.COM
COMMAND.COM is the filename of the default operating system shell for DOS operating systems and the default command line interpreter on Windows 95, Windows 98 and Windows Me...

. Because Scott's Valley has never been fully analysed, it is unknown whether it also infects OVL files as most Jerusalem variants do.

Symptoms

Scott's Valley is only partially analysed, and as such, this list of symptoms may be incomplete.
  • COM files executed will increase by 2,131 bytes in size; EXE files will increase by between 2,131 and 2,140 bytes.
  • Interrupt
    Interrupt
    In computing, an interrupt is an asynchronous signal indicating the need for attention or a synchronous event in software indicating the need for a change in execution....

    21 will be hooked.
  • Infected files will contain the seemingly meaningless hex string 5E8BDE909081C63200B912082E.


Scott's Valley is a member of the Slow virus family, which has been associated with system slowdowns, although this symptom is unconfirmed. This could stem from the Slow virus' (and thus the Scott's Valley virus') relationship to the Jerusalem virus, which slowed down the system after 30 seconds and displayed a black box in the lower lefthand corner. It is not believed that Scott's Valley exhibits the "black box" behaviour, nor that it carries Jerusalem's destructive payload.

Prevalence

The WildList http://www.wildlist.org/, an organisation tracking computer viruses, never reported Scott's Valley as being in the field. Although it was isolated in the field spreading in California, there is no evidence to suggest it ever became common. Like most older, rare DOS viruses, it is probable that Scott's Valley has become extinct, and obsolete at the minimum.

External links

The source of this article is wikipedia, the free encyclopedia.  The text of this article is licensed under the GFDL.
 
x
OK