Diamond

Classification

Malware

Virus

-

Diamond, 1024

Summary

This virus has been reported as bearing some resemblance to the "Eddie" virus, possibly written by the "Dark Avenger" as well. The virus makes some effort to disable any debugger program used to monitor it, but does not seem to do anything of particular interest.

Automatic action

Based on the settings of your F-Secure security product, it will either move the file to the quarantine where it cannot spread or cause harm, or remove it.

Suspect a file is incorrectly detected (a False Positive)?

A False Positive is when a file is incorrectly detected as harmful, usually because its code or behavior resembles known harmful programs. A False Positive will usually be fixed in a subsequent database update without any action needed on your part. If you wish, you may also:

  • Check for the latest database updates

    First check if your F-Secure security program is using the latest detection database updates, then try scanning the file again.

  • Submit a sample

    After checking, if you still believe the file is incorrectly detected, you can submit a sample of it for re-analysis.

    NOTE If the file was moved to quarantine, you need to collect the file from quarantine before you can submit it.

  • Exclude a file from further scanning

    If you are certain that the file is safe and want to continue using it, you can exclude it from further scanning by the F-Secure security product.

    Note You need administrative rights to change the settings.

For more Support

Knowledge Base

Find the latest advice in our Community Knowledge Base.

User Guide

See the user guide for your product on the Help Center.

Contact Support

Chat with or call an expert for help.

Submit a sample

Submit a file or URL for further analysis.

Technical Details


Variant:Damage, Damage-2, David, Greemlin, Lucifer, Sathanyk

Variants which have been changed in various ways, but are not particularly interesting.


Variant:Rock Steady

Size:666

Other:Resident, COM/EXE-files

Rock Steady is a memory resident file infector which infects any excuted files.

When an infected file is executed, the virus checks whether the date is 13th of any month. On every other day the virus will install itself to memory and hook INT 21h.

The INT 21h handler defines the residence test, intercepts DOS functions 4B00h (load/exec) and 4B01h (loadprog) to infect files, and traps DOS functions 11h (FCB find first) and 12h (FCB find next) to hide the symptoms of infection. If the seconds field is 60 it is returned as 0, and the virus size (666 bytes) is subtracted from the file length.

If an infected program is run on the 13th of any month, the first 1 to 10 cylinders of the first hard disk are formatted (head 0 only) using int 13h. Next the first 32 logical sectors of drive C: are overwritten with garbage and then the machine is rebooted with int 19h.

When the virus infects a file, it will check whether it begins with 'MZ' or 'ZM'. In these cases the virus will flag the file as EXE file. One interesting point is that if the file begins with 'ZM', virus will change it to 'MZ'. Virus will not infect any files which are less than 666 bytes, and also not COM files which are bigger than 64358 bytes. Infected files contain a text string which says '!RocK STeaDY!'. Virus marks infected files by setting seconds field to 60.