Can MIDI (.mid) files have a virus ?

There isn't any reason why a midi file couldn't be used as an attack vector. There was at least one virus that used image files to exploit flaws in the image processing engines of various web browsers. If fact, any program that reads in a data file can be exploited if the program is not coded to correctly handle unexpected information.
 
Fortunately most modern software is coded to handle such cases and I'm personally unaware of any malware that exploits undiscovered flaws in DAWs or MIDI players, but that doesn't mean they aren't out there! And ya gotta watch out for that really old software.
 
To address your issue, I would guess that complex or poorly composed MIDI sequences, perhaps with lots of PC's, CC's and such could stress the sequencer or a virtual instrument to the point where dropouts occur, but I don't know for sure. There are some preference settings that specifically address midi performance that you might want to read up on. Unfortunately I don't remember what they are called, but I believe they have to do with caching. Hopefully someone else can chime in on that one.
 
Keep virus-scanning those files!
 
 

Given everything already mentioned combined with the fact that the issue is occurring in an unrelated project, I doubt the MIDI file has anything all to do with your issue. If you haven't re-booted recently, that would be a good place to start.
 
Instability in SONAR is most often associated with plugins or problems with interface drivers. If no changes have been made to the system or SONAR audio config, and you've rebooted,  the next place to look would be the plugins that were most recently added to the crashing project.

SonicExplorer
can somebody give me a quick explanation of what Sysex data is about

https://en.wikipedia.org/wiki/MIDI
 

Messages

A MIDI message is an instruction that controls some aspect of the receiving device. A MIDI message consists of a status byte, which indicates the type of the message, followed by up to two data bytes that contain the parameters. MIDI messages can be channel messages sent on only one of the 16 channels and monitored only by devices on that channel, or system messages that all devices receive. Each receiving device ignores data not relevant to its function. There are five types of message: Channel Voice, Channel Mode, System Common, System Real-Time, and System Exclusive.

Channel Voice messages transmit real-time performance data over a single channel. Examples include "note-on" messages which contain a MIDI note number that specifies the note's pitch, a velocity value that indicates how forcefully the note was played, and the channel number; "note-off" messages that end a note; program change messages that change a device's patch; and control changes that allow adjustment of an instrument's parameters. MIDI notes are numbered from 0 to 127 assigned to C-1 to G9. This corresponds to a range of 8.175798916Hz to 12543.85395Hz (assuming equal temperament and 440Hz A4) and extends beyond the 88 note piano range from A0 to C8.

Channel Mode messages include the Omni/mono/poly mode on and off messages, as well as messages to reset all controllers to their default state or to send "note-off" messages for all notes.

System messages do not include channel numbers, and are received by every device in the MIDI chain. MIDI time code is an example of a System Common message. System Real-Time messages provide for synchronization, and include MIDI clock and Active Sensing.

System Exclusive messages

System Exclusive (SysEx) messages are a major reason for the flexibility and longevity of the MIDI standard. Manufacturers use them to create proprietary messages that control their equipment more thoroughly than standard MIDI messages could. SysEx messages are addressed to a specific device in a system. Each manufacturer has a unique identifier that is included in its SysEx messages, which helps ensure that only the targeted device responds to the message, and that all others ignore it. Many instruments also include a SysEx ID setting, so a controller can address two devices of the same model independently. SysEx messages can include functionality beyond what the MIDI standard provides. They target a specific instrument, and are ignored by all other devices on the system.

SonicExplorer
 
......can somebody give me a quick explanation of what Sysex data is about and how I might find and edit it per advice above from @promidi ?

In a nutshell, SYSEX is a string of characters embedded in a MIDI file that tells (mostly hardware) synths how to set up a sound, various parameters to use and whatnot. SYSEX events are usually specific to the synth that you're controlling.  For instances, a Roland GS device would usually ignore SYSEX data intended for a Yamaha XG device

If you are using soft synths and your MIDI file does indeed contain SYSEX data, then it is usually safe to simply back up the MIDI file, then delete the sysex data.

That being said, I have experienced repeatable crashes in some versions of Sonar and CbB that I confirmed to be caused by dense SYSEX data in a MIDI only project.  This project was purely MIDI only (driving hardware synths).  There were no audio tracks at all - and definitely no plugins.

The best way to find it in Sonar or CbB is to use the event list view - or use the Sysex view

If you're "hand-tabbing", and which is only driving a soft synth plug-in, then it's unlikely SYSEX is being injected into Sonar during this process and therefore SYSEX is not the culprit in this instance.  You need to look elsewhere. 

You might want to start a new thread with the title "Play back of MIDI events I created crashes Sonar" or something like that.  Then proceed to mention things like your OS and machine specs.  Which soft synth plug-in you're using.  Whether the soft synth plug-in is 32 bit or 64bit.

I was tackling your original question "Can MIDI (.mid) files have a virus"