Scott's Valley

Infection

Scott's Valley is a very standard memory resident DOS file infector. Upon execution, it goes memory resident and infects COM and EXE files as they are opened. It does not infect COMMAND.COM. Because Scott's Valley has never been fully analysed, it is unknown whether it also infects OVL files as most Jerusalem variants do.

Symptoms

Scott's Valley is only partially analysed, and as such, this list of symptoms may be incomplete.

• COM files executed will increase by 2,131 bytes in size; EXE files will increase by between 2,131 and 2,140 bytes.
• Interrupt 21 will be hooked.
• Infected files will contain the seemingly meaningless hex string .

Scott's Valley is a member of the Slow virus family, which has been associated with system slowdowns, although this symptom is unconfirmed. This could stem from the Slow virus' (and thus the Scott's Valley virus') relationship to the Jerusalem virus, which slowed down the system after 30 seconds and displayed a black box in the lower lefthand corner. It is not believed that Scott's Valley exhibits the "black box" behaviour, nor that it carries Jerusalem's destructive payload.

Prevalence

The WildList http://www.wildlist.org/ , an organisation tracking computer viruses, never reported Scott's Valley as being in the field. Although it was isolated in the field spreading in California, there is no evidence to suggest it ever became common. Like most older, rare DOS viruses, it is probable that Scott's Valley has become extinct, and obsolete at the minimum.