Companion viruses are very clever. They create a new program with a file name of an existing program. The idea is for the user to attempt to run the program that they normally run, but then run the virus program instead. It can be as simple as taking a program called "game.exe" and creating a virus program called "game.com," to get the "game.com" file to execute by tricking the user. this works really well in DOS based systems or where the user makes use of the "Run..." dialog box in a Windows based environment. This is sometimes called "Spawning."
Companion viruses use a feature of DOS that allows software programs with the same name, but with different extensions, to operate with different priorities. Instead of modifying an existing file, creates a new program which (unknown to the user) is executed instead of the intended program. On exit, the new program executes the original program so that things appear normal. Most companion viruses create a COM file which has a higher priority than an EXE file with the same name.
A companion virus does not attach itself to other programs; rather it infects executable files by creating a companion file with the same name and a .COM extension. Because DOS executes .COM files before .EXE files and .BAT files, the virus loads before the actual program .EXE file and the system appears normal.
viruses that spread via a file which runs instead of the file the user intended to run, and then runs the original file. For instance, the file MYAPP.EXE might be 'infected' by creating a file called MYAPP.COM. Because of the way DOS works, when the user types MYAPP at the C prompt, MYAPP.COM is run instead of MYAPP.EXE. MYAPP.COM runs its infective routine, then quietly executes MYAPP.EXE. Please note that this is not the only type of companion (or 'spawning') virus.
A virus that creates a new program with the same file name as an existing program, but in a different place or with a different file type, so that typing the program's name on the command line causes the virus program to be executed instead of the original program.
When two MS-DOS executables only differ in their data type (i.e. file suffix), the one with the suffix .com is run before the one with the suffix .exe. Companion viruses exploit this feature. For example, a companion virus could copy itself into the DOS directory under the name 'DIR.COM'. If the user then wants to display the directory's contents, the virus is run, rather than the intended program 'DIR.EXE'.
a virus that takes advantage of a quirk in DOS
A companion virus will rename either itself or its target file in an attempt to trick the user into running the virus rather than another program. For example, a companion virus attacking a file named GAME.EXE may rename the target file to GAME.EX and create a copy of itself called GAME.EXE. Alternatively, it may simply rename itself to GAME.COM and rely on the user running "GAME" from a command prompt as the operating system would then run GAME.COM rather than GAME.EXE.
A virus that creates a new program with the same file name as an existing program, but in a different place or with a different file type. If the program's name is typed on the command line causes the virus program is activated instead of the original program.
A virus that exploits the fact that when there are two programs with the same name, the operating system uses the file extension to decide which one to run. For example, DOS computers will run a .com file in preference to an .exe file. The virus creates a .com file containing the virus code and gives it the same name as an existing .exe. file.
A viral program that does not actually attach to another program, but which uses a similar name and the rules of program precedence to associate itself with the regular program.
Companion viruses use a feature of DOS that allows software programs with the same name, but with different extensions, to operate with different priorities. Most companion viruses create a COM file which has a higher priority than an EXE file with the same name. Thus, a virus may see a system contains the file PROGRAM.EXE and create a file called PROGRAM.COM. When the computer executes PROGRAM from the command line, the virus (PROGRAM.COM) runs before the actual PROGRAM.EXE. Often the virus will execute the original program afterwards so the system appears normal.
This type of viruses use other techniques to associate with other programs. For instance, where there exists an executable EXE file, the virus creates another file of the same name but with a COM extension, which it hides from the user in order not to raise suspicion. The new file it creates contains the virus itself. The operating system, upon finding two files of the same name, will run the COM version, thereby executing the virus. Once the virus has been executed, it hands the control back over to the operating system so that it can run the original EXE file. This way, the user will never know that the virus has been activated. These viruses are also known with the following name: Spawning.
A virus which infects executable files by creating a 'companion' file with the same name but an .COM extension. Since DOS executes .COM files, followed by .EXE files, and finally .BAT files, the virus loads before the executable file.
A specialized type of virus that doesn't modify its host. Instead it creates its own file with the same file name as the host but a different file extention that DOS will execute first.