Sunday Virus

Virus Name: Sunday Aliases: V Status: Common Discovered: November, 1989 Symptoms: TSR; executable file growth; messages; FAT corruption Origin: Washington (state), United States Eff Length: 1,636 Bytes Type Code: PRsAT - Parasitic Resident .COM, .EXE. & .OV? Infector Detection Method: ViruScan, F-Prot, AVTK, NAV, Sweep, IBMAV, NAVDX, VAlert, PCScan, ChAV, NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, NAV/N, IBMAV/N Removal Instructions: F-Prot, NAV, or delete infected files General Comments: The Sunday virus was discovered by many users in the Seattle, Washington area in November, 1989. This virus activates on any Sunday, displaying the message: "Today is Sunday! Why do you work so hard? All work and no play make you a dull boy! Come on! Let's go out and have some fun!" The Sunday virus appears to have been derived from the Jerusalem virus, the viral code being similar in many respects. Damage to the file allocation table or FAT has been reported from a number of infected users. Known variant(s) of Sunday are: Sunday-B: Similar to the Sunday virus, this variant does not activate on any day of the week due to an error in the day of the week checking routine. The message in the virus is never displayed, and no damage is done to the file allocation table. Sunday-C: Similar to Sunday-B, this variant also never activates. It has, however, been modified so that it differs from both the Sunday and Sunday-B viruses. Functionally, it is the same as Sunday-B. Sunday.Satan: Similar to the Sunday virus, this variant's low system memory TSR is 1,936 bytes in size, hooking interrupts 08 and 21. It infects .COM and .EXE programs, including COMMAND.COM, when they are executed. .COM files increase in size by 1,636 bytes with the virus being located at the beginning of the file. .EXE files increase in size by 1,636 to 1,650 bytes with the virus being located at the end of the file. The program's date and time in the DOS disk directory listing will not be altered. The following text strings are visible within the viral code in all infected programs: "-Satan-" "* Satan Virus *Carzy !! Another Masterpiece of Satan....." "Written by Mad Satan in TAIWAN .\ Version 2.04 /" "= Mad Satan =" Origin: Taiwan April 1994. Sunday-UNAM: Similar to the Sunday virus, this variant's low system memory TSR is 1,872 bytes in size, hooking interrupts 08 and 21. It infects .COM and .EXE programs, other than COMMAND.COM, when they are executed. .COM files increase in size by 1,636 bytes with the virus being located at the beginning of the file. .EXE files increase in size by 1,636 to 1,650 bytes with the virus being located at the end of the file. The program's date and time in the DOS disk directory listing will not be altered. On Sundays, it will display the following message, accompanied with a strange sound on the system speaker: "El talento no impide tener manias, pero las hace mas notables. Saludos porros de la UNAM" This message and sound are repeated every 12 seconds. The above text strings are visible within the viral code in infected programs, as is the following text string: "COMMAND.COM" Origin: Mexico City, Mexico April 1993. See: Carfield Jerusalem Sunday-2