Virus Encyclopedia
Welcome to the Virus Encyclopedia of Panda Security.
Stream | |
Threat Level Damage Distribution |
At a glance
 |
| Common name: | Stream |
| Technical name: | VBS/Stream |
| Threat level: | Low |
| Alias: | Stream.A, Potok, VBS/Potok@MM, VBS.Potok.A, VBS/Potok, VBS/Vdrive@MM |
| Type: | Worm |
| Effects: | It creates two files in order to connect to the network the infected computer belongs to. |
| Affected platforms:
| Windows ME/98/95 |
| Detection updated on: | Nov. 13, 2002 |
| Statistics | No |
Brief Description | |
| Stream is a worm very easy to identify as it spreads in an e-mail message that refers to a new generation of drivers for video cards. Furthermore, the e-mail mentions Microsoft as the source of the information it supposedly provides. This virus spreads very quickly through the following means of propagation: - E-mail messages with the New generation of drivers subject and the DRIVER.DOC. VBS attached file (there are 56 spaces between the two extensions).
- These e-mails are automatically sent to the 50 first contacts in the Address Book.
- Across the affected computer’s network. To do this, Stream creates two files that allow it to connect to the network as a regular user.
Stream only affects Windows 2000 Pro and Windows NT computers (computers with NTFS file systems). This worm is not considered dangerous as its only purpose is to spread to other computers and connect to the affected computer’s network as just another user. |
Visible Symptoms | |
A clear indication that Stream has arrived to the system is the reception of an e-mail message with the following characteristics: |
Tech details
Effects |
To carry out its infection, Stream follows the routine below: It creates the following files: It copies itself to the Windows directory. GO.VBS, in the C:\Winnt\System32 directory. NOTEPAD.VBS, in the C:\Winnt\System32\ras directory.
Stream uses these two files to connect to the infected computer’s network as another user and spread across it. |
Means of transmission
Stream spreads very quickly, both via e-mail and across the infected computer’s network. Note: the worm can spread across networks only on Windows 200 Pro and Windows NT computers (computers with NTFS file systems).
Infection via e-mail:
- It reaches computers hidden in an e-mail message with the following characteristics:
Subject:
New generation of drivers
Message:
Microsoft has published new driver for all types Video Cards, compatible with Windows 95/98/NT/2000/XP.
You can read about it in attachment document
Best wishes,
Microsoft
Attachments:
DRIVER.DOC. VBS
The name of this file has 56 blank spaces between its two extensions (DOC and VBS). This can make users notice the first extension only (DOC) and run the file in the belief that it is a harmless Word file.
Infection across networks:
Stream can only spread across networks if the affected computer has the Windows 2000 Pro or Windows NT operating system installed (that is, on computers with NTFS file systems).
