Sunday (computer virus)
Encyclopedia
Sunday is a computer virus
Computer virus
A computer virus is a computer program that can replicate itself and spread from one computer to another. The term "virus" is also commonly but erroneously used to refer to other types of malware, including but not limited to adware and spyware programs that do not have the reproductive ability...

, a member of the Jerusalem virus family. It was discovered in November 1989 after a number of simultaneous reports from Seattle, Washington
Seattle, Washington
Seattle is the county seat of King County, Washington. With 608,660 residents as of the 2010 Census, Seattle is the largest city in the Northwestern United States. The Seattle metropolitan area of about 3.4 million inhabitants is the 15th largest metropolitan area in the country...

, United States
United States
The United States of America is a federal constitutional republic comprising fifty states and a federal district...

, and surrounding areas. Several other Seattle outbreaks, including AirCop, were later traced to Asia.

Infection

Sunday is a standard patched Jerusalem variant in the way it infects files. It is a directly modified version of the original Jerusalem.1803. It infects .EXE
EXE
EXE is the common filename extension denoting an executable file in the DOS, OpenVMS, Microsoft Windows, Symbian, and OS/2 operating systems....

, .COM
COM file
In many computer operating systems, a COM file is a type of executable file; the name is derived from the file name extension .COM. Originally, the term stood for "Command file", a text file containing commands to be issued to the operating system , on many of the Digital Equipment Corporation mini...

, and .OVL files. Like the original Jerusalem, infected files occasionally become corrupted.

Symptoms

Sunday is less easily identified than the original Jerusalem, in part because of corrected errors and in part because its payload is poorly written and fails to execute.
  • COM and EXE files increase by size. COM files increase by a set amount, while EXE files increase by somewhere between that amount and 9 or 10 bytes less. Unlike the original Jerusalem, files will not be infected many times.
  • Interrupt
    Interrupt
    In computing, an interrupt is an asynchronous signal indicating the need for attention or a synchronous event in software indicating the need for a change in execution....

     21 will be hooked.
  • Infected files will contain the string "Today is SunDay! Why do you work so hard? All work and no play make you a dull boy
    All work and no play makes Jack a dull boy
    All work and no play makes Jack a dull boy is a proverb. It means that without time off from work, a person becomes both bored and boring.-History:...

    ! Come on! Let's go out and have some fun!"


The capitalization of "Sunday" is reported variously as "Sunday" or "SunDay", and may depend on the variant.

Because of an error in coding, the virus fails to execute its payload, intended to set off on Sundays of every year other than 1989. This is to print the previously indicated text on the screen and then delete all files run while the virus is memory resident, as the original Jerusalem did every February the 13th.

Prevalence

The WildListhttp://www.wildlist.org/, an organisation tracking computer viruses, listed Sunday as spreading in various forms from shortly after the list was started until 1998. Like all DOS viruses, Sunday suffered with the debut of Windows
Microsoft Windows
Microsoft Windows is a series of operating systems produced by Microsoft.Microsoft introduced an operating environment named Windows on November 20, 1985 as an add-on to MS-DOS in response to the growing interest in graphical user interfaces . Microsoft Windows came to dominate the world's personal...

. It is now considered obsolete, although the virus was common enough that the use of previously dormant files has resulted in recent infections. However, anything other than a localised outbreak is unlikely.
The source of this article is wikipedia, the free encyclopedia.  The text of this article is licensed under the GFDL.
 
x
OK