This Virus attaches itself to legitimate programs and then creates a program with a different file extension. This file may reside in the temporary directory of your system. When the user types the name of the legitimate program, the companion virus executes instead of the real program. This effectively hides the virus from the user. Many of the viruses that are used to attack Windows systems make changes to program pointers in the Registry so that it points to the infected program. The infected program may perform its dirty deed and then start the real program.