Вирус Scott's Valley: описание и анализ

Computer virus

is a computer virus, a member of the Slow virus family and distantly related to the Jerusalem virus family. It was discovered in September 1990 in Scotts Valley, California. It is named after the city of Scotts Valley, although that is spelled without an apostrophe.

Scott's Valley is a very standard memory resident DOS file infector. Upon execution, it goes memory resident and infects COM and EXE files as they are opened. It does not infect COMMAND. COM. Because Scott's Valley has never been fully analysed, it is unknown whether it also infects OVL files as most Jerusalem variants do.

Scott's Valley is only partially analysed, and as such, this list of symptoms may be incomplete. COM files executed will increase by 2,131 bytes in size; EXE files will increase by between 2,131 and 2,140 bytes. Interrupt 21 will be hooked. Infected files will contain the seemingly meaningless hex string 5E8BDE909081C63200B912082E. Scott's Valley is a member of the Slow virus family, which has been associated with system slowdowns, although this symptom is unconfirmed. This could stem from the Slow virus' (and thus the Scott's Valley virus') relationship to the Jerusalem virus, which slowed down the system after 30 seconds and displayed a black box in the lower lefthand corner. It is not believed that Scott's Valley exhibits the "black box" behaviour, nor that it carries Jerusalem's destructive payload.

The WildList , an organisation tracking computer viruses, never reported Scott's Valley as being in the field. Although it was isolated in the field spreading in California, there is no evidence to suggest it ever became common. Like most older, rare DOS viruses, it is probable that Scott's Valley has become extinct, and obsolete at the minimum.