Scores is introduced to a system when an infected program is run. The virus drops the files "Scores" and "Desktop" into the system folder and infects the System, Notepad and Scrapbook files. It stays dormant for two days after infecting the system folder. Three different functions "wake up" seperately after two, four and seven days. After two days, the virus will infect any file that is run.
After four days, it checks if any programs with the signatures ERIC or VULT are running. If so, the virus crashes these programs after 25 minutes. If the Macsbug debugger is installed, the user will receive a user break. If no debugger is installed, the system will crash.
After seven days, if a program with the VULT signature is run, the virus will stop any attempt to write to a disk. If there are no other attempts to write to a disk for 10 minutes, the program will crash like it does after four days. The virus also contains code in its seven-day sequence to cause a crash after forty-five minutes, but this is never used, because the code to cause a crash after twenty-five is still active.
Donald D. Burleson of Fort Worth, Texas, USA was accused of creating the virus. He was beieved to have planted the virus in the computers of the USPA & IRA company, from which he was recenty fired. The firm claimed to have lost 168,000 because of the virus. USPA & IRA was awarded 12,000.
In spite of the fact that it was targeted at Electronic Data Systems, it caused little or no damage there.
The virus infected computers at NASA in July of 1988. It was reported to have destroyed information on personal computers. NASA believed the damage was bad enough to get the FBI involved. It also supposedly spread to other government agencies, including the Environmental Protection Agency, the National Oceanic and Atmospheric Administration and the United States Sentencing Commission.
The virus was also seen in a major outbreak at Washington State University in November of 1988. It was first sighted at the University's Computing Information Center, but later spread to staff computers and the University Microcomputer lab. They also instituted a policy of "disk washing", where disks that were taken from the Microcomputer Lab then returned had to be cleaned by copying over them with new software.
The Scores virus gets its name from the file it drops in the system folder. It also goes by the less common names ERIC and VULT, as the virus looks for these programs and tries to crash them. The virus is also sometimes called NASA because it became widespread there. Yet another name is San Jose Flu.
The virus was created to target the ERIC and VULT programs. At first, it was uncertain what these programs were, or if they even existed. It was later found that these were proprietary projects of the Plano, Texas based ELectronic Data Systems.
At the time of its release, there were around 40 viruses in the wild.
John Norstad. INFO-MAC Digest, Volume 6, Issue 40, The Scores Virus 1988.04.18 (from the VIRUS-L Newsgroup)
Symantec Antivirus, Scores
Joe Morris. VIRUS-L Virus Discussion List A Computer Virus Case Goes to Trial. 1988.09.08
Keith Petersen. VIRUS-L Virus Discussion List, FBI to investigate rogue computer program at NASA. 1988.07.06
Joshua Yeidel. VIRUS-L Virus Discussion List, SCORES Virus (Mac) Sighted At Washington State U. 1988.11.22