Stream
Threat LevelDamageDistribution

Infection strategy 

To carry out its infection, Stream follows the routine below:

It creates the following files:

• It copies itself to the Windows directory.
• GO.VBS, in the C:\Winnt\System32 directory.
• NOTEPAD.VBS, in the C:\Winnt\System32\ras directory.

Stream uses these two files to connect to the infected computer’s network as another user and spread across it.

Means of transmission 

Stream spreads very quickly, both via e-mail and across the infected computer’s network. Note: the worm can spread across networks only on Windows 200 Pro and Windows NT computers (computers with NTFS file systems).

Infection via e-mail:

• It reaches computers hidden in an e-mail message with the following characteristics:

   

  Subject:
  New generation of drivers

  Message:
  Microsoft has published new driver for all types Video Cards, compatible with Windows 95/98/NT/2000/XP.
  You can read about it in attachment document
  Best wishes,
  Microsoft

  Attachments:
  DRIVER.DOC.    VBS
  The name of this file has 56 blank spaces between its two extensions (DOC and VBS). This can make users notice the first extension only (DOC) and run the file in the belief that it is a harmless Word file.

• It activates when the attached file is run: DRIVER.DOC.                 VBS.
• It sends itself automatically to the first 50 contacts in the Address Book.

Infection across networks:

Stream can only spread across networks if the affected computer has the Windows 2000 Pro or Windows NT operating system installed (that is, on computers with NTFS file systems).