Sunday A&B Viruses (15-June-1990)
Entry...............: Sunday A & B Viruses
Alias(es)...........: ---
Virus Strain........: Israeli-Virus
Classification......: Program Virus (extending), RAM-resident
Length of Virus.....: .COM files: length increases by 1636 bytes.
                      .EXE files: length increases by 1638-1647 bytes.
                      .OVL files: length increases by 1638-1647 bytes.
--------------------- Preconditions ----------------------------------
Operating System(s).: MS-DOS,PC-DOS
Version/Release.....: 2.xx upward
Computer model(s)...: IBM-PC, XT, AT and compatibles
--------------------- Attributes -------------------------------------
Easy Identification.: Typical texts in Virus body (readable
                         with HexDump-facilities):
                         "Today is SunDay" (Part of Message)
Type of infection...: System: infected if function FFh of INT 21h
                         returns value 0400h in the AX-register.
                      Files : The virus infects .COM, .EXE and overlay
                         files. Generaly, files only infected once.
Infection Trigger...: Programs are infected at load time (using the
                         function Load/Execute of MS-DOS).
Interrupts hooked...: INT21h, INT08h
Damage..............: Sunday Version A:
                      30 minutes after the FIRST infected programm
                         was run, the virus displays this message:
                         "Today is SunDay! Why do you work so hard?
                          All  work and no play make you a dull boy!
                          Come on! Let's go out and have some fun!"
                      Sunday Version B:
                      If the first infected file was run, every
                         loaded program is deleted.
Damage Trigger......: Every Sunday, if year of date not equal 1989
Particularities.....: The version of the SUNDAY that we have named
                         "B" includes version "A", except that the 
                         typical message is not displayed on Sunday.
--------------------- Agents -----------------------------------------
Countermeasures.....: The virus will be detected by :
                         VIRSUCH  2.15 (D. Hoppenrath)
                         SCAN     3.1  (McAfee)
--------------------- Acknowledgement --------------------------------
Location............: Virus Test Center, University Hamburg, FRG
Classification by...: J|rg Steindecker
Documentation by....: J|rg Steindecker
Date................: June 15, 1990
Updates by..........: ---

.