****** Infecting ENUNS COM files - Win95/98 COM files ******
                            By: Techno Phunk / TI



[Introduction]

        so, this is why my COM infector don't work when I infect some
COM files? Well, I hate COM infectors, let me get that out, but,
sometimes, you need to infect DOS 7+ COM files...First of all
what in the world is a ENUNS com file?....well, basicly, it's a COM file
usualy located in c:\windows\command\*.com that has the TEXT string...
ENUNSxy, where x and y are variables....the variables are the size of the
file.....so, I could stop here....as it should be coming to you by now, but
basicly, all we have to do, is make windows think that the file is the right
size....Because, otherwise, it isn't going to run, but hang (that was a lame
idea). Btw- This was first discussed by Yosha.

[What to Do]

        Well, as some great person, of some unknown time, said "you gotta do,
what ya gotta do."....well, here's your good ol' theory....so, gather
around kids it's time for Techno Phunk's story time. O.k, first of all we
must know how to infect a regular ol' COM file (barf), but, I will not cover
this, as this is not the purpose of this tutorial....This tutorial is SOLEY
for teaching you, how to add MORE infections to your viruses. Now, the
fun part... Basicly here's what we *have* to do in order to infect these
files "correctly"...

        * Move file pointer to the end of host...

                Mov Ah,4202h  ; end of file
                Mov Dx, -7    ; but back 7 bytes
                Dec Cx        ; just for so, CX must = 0 to do this (duh)
                Int 21h

        * read the LAST 7 bytes into a buffer...e.g:

                         Hello This Is A Example

                         What we read in is: Example

                Mov Ah,3fh
                Mov Cx,7
                Lea Dx, [Bp+xy]
                Int 21h


        * Anyhow, so we read in those last 7 bytes....Next  step
        * ADD to values xy (in our example above: le) the SIZE of our virus
          (no fancy calculations, just add <G>) so

                Add Word Ptr [Bp+xy],(end-start)

        * finaly, we simply, infect the file as usual, and THEN
          we must WRITE to the *VERY END* of the infected file...
          the new string: ENUNSvX  where v and X will = the old + virus size.

so...our infected file will look like this.

<jump to virus>
<host>
<old ENUNS and value...you can destroy, to be more painful to AV restoration>
 ^ not realy that much of a pain, but have fun doing it anyhow <G>
<VIRUS CODE>
<string: ENUNS host+virus>

[Really Short Conclusion]

Understand? I should hope so.....

Now, you can go add this to your newest virus, and infect even more files
and file types. More power to ya.


Have some fun!

- Techno Phunk
  tinet@sourceofkaos.com