A few older viruses called companion viruses do not have host files per se, but exploit MS-DOS. A companion virus creates new files (typically .COM but can also use other extensions such as .EXE) that have the same file names as legitimate .EXE files. When a user types in the name of a desired program, if he does not type in .EXE but instead does not specify a file extension, DOS will assume he meant the file with the extension that comes first in alphabetical order and run the virus. For instance, if a user had (filename).COM (the virus) and (filename).EXE and the user typed filename, he will run (filename).COM and run the virus.
The virus will spread and do other tasks before redirecting to the legitimate file, which operates normally. Some companion viruses are known to run under Windows 95 and on DOS emulators on Windows NT systems. Path companion viruses create files that have the same name as the legitimate file and place new virus copies earlier in the directory paths. These viruses have become increasingly rare with the introduction of Windows XP, which does not use the MS-DOS command prompt.
last modified: 2009-04-27 18:07:28