A few older viruses called companion viruses do not have host files per se, but exploit _MS-DOS. A companion virus creates new files (typically _.COM but can also use other extensions such as _.EXE) that have the same file names as legitimate _.EXE files. When a user types in the name of a desired program, if he does not type in _.EXE but instead does not specify a file extension, _DOS will assume he meant the file with the extension that comes first in alphabetical order and run the virus. For instance, if a user had _{(filename).COM} (the virus) and _{(filename).EXE} and the user typed _filename, he will run _{(filename).COM} and run the virus.

The virus will spread and do other tasks before redirecting to the legitimate file, which operates normally. Some companion viruses are known to run under ^{Windows 95} and on _{DOS emulators} on ^{Windows NT} systems. Path companion viruses create files that have the same name as the legitimate file and place new virus copies earlier in the directory paths. These viruses have become increasingly rare with the introduction of ^{Windows XP}, which does not use the _{MS-DOS command prompt}.

feedback form

feedback form

Any feedback you provide (corrections, updates or suggestions) are sent to the owner of this FAQ
and anyone else involved in writing or editing this item.

by uid1307457
last modified: 2009-04-27 18:07:28