How It Works

A companion virus takes a pre-existing file and makes a copy of it with a different extension. The most common extension given to a copied file is .COM. For example a companion virus would take a file on the host such as run.exe and make a copy called run.com.
Usually such a virus would scan the host looking for directories containing executable files. It would then copy the executables file name and append the .com extension. This new file would be placed either in a directory containing the original file or into another one which might have precedence with respect to file execution. The infected host would then run the program run.exe unbeknowst to them actually runs the infected file, infecting the host.