This virus has been reported as bearing some resemblance to the "Eddie"
virus, possibly written by the "Dark Avenger" as well. The virus makes
some effort to disable any debugger program used to monitor it, but does
not seem to do anything of particular interest.
Rock Steady is a memory resident file infector which infects any
excuted files.
When an infected file is executed, the virus checks whether the
date is 13th of any month. On every other day the virus will
install itself to memory and hook INT 21h.
The INT 21h handler defines the residence test, intercepts DOS
functions 4B00h (load/exec) and 4B01h (loadprog) to infect files,
and traps DOS functions 11h (FCB find first) and 12h (FCB find
next) to hide the symptoms of infection. If the seconds field
is 60 it is returned as 0, and the virus size (666 bytes) is
subtracted from the file length.
If an infected program is run on the 13th of any month, the first
1 to 10 cylinders of the first hard disk are formatted (head 0
only) using int 13h. Next the first 32 logical sectors of drive
C: are overwritten with garbage and then the machine is rebooted
with int 19h.
When the virus infects a file, it will check whether it begins
with 'MZ' or 'ZM'. In these cases the virus will flag the file
as EXE file. One interesting point is that if the file begins
with 'ZM', virus will change it to 'MZ'. Virus will not infect
any files which are less than 666 bytes, and also not COM files
which are bigger than 64358 bytes. Infected files contain a
text string which says '!RocK STeaDY!'. Virus marks infected files
by setting seconds field to 60.
