Stream

Windows ME/98/95

Stream is a worm very easy to identify as it spreads in an e-mail message that refers to a new generation of drivers for video cards. Furthermore, the e-mail mentions Microsoft as the source of the information it supposedly provides.

This virus spreads very quickly through the following means of propagation:

• E-mail messages with the New generation of drivers subject and the DRIVER.DOC.          VBS attached file (there are 56 spaces between the two extensions).
• These e-mails are automatically sent to the 50 first contacts in the Address Book.  
• Across the affected computer’s network. To do this, Stream creates two files that allow it to connect to the network as a regular user.  

Stream only affects Windows 2000 Pro and Windows NT computers (computers with NTFS file systems). This worm is not considered dangerous as its only purpose is to spread to other computers and connect to the affected computer’s network as just another user.

A clear indication that Stream has arrived to the system is the reception of an e-mail message with the following characteristics:

• Content:

  Microsoft has published new driver for all types Video Cards, compatible with Windows 95/98/NT/2000/XP.
  You can read about it in attachment document
  Best wishes,
  Microsoft

• Attachment:

  DRIVER.DOC.    VBS (the name of the file contains 56 blank spaces between the two extensions: DOC and VBS).