W2K.Stream

W2K.Stream virus was discovered in early September 2000. The virus was created by Benny and Ratter of the 29A virus group. This virus is a proof-of-concept virus that utilizes NTFS streams and has received much attention. It is a new subclass of the traditional companion virus and is now being referred to as the "Stream Companion" virus.

W2K.Stream virus only infects files on Windows 2000 using NTFS, and only the files in the same directory. The infected files will become 3,628 bytes in size regardless of the original file size because the original host file is replaced by the virus and stored in a different stream.

As of September 7, 2000, Symantec AntiVirus Research Center has received no reports of this virus in the wild, and it is considered a very low threat.

Protection

• Initial Rapid Release version September 5, 2000
• Latest Rapid Release version January 20, 2009 revision 039
• Initial Daily Certified version September 5, 2000
• Latest Daily Certified version January 20, 2009 revision 037
• Initial Weekly Certified release date September 5, 2000

Click here for a more detailed description of Rapid Release and Daily Certified virus definitions.

Threat Assessment

Wild

• Wild Level: Low
• Number of Infections: 0 - 49
• Number of Sites: 0 - 2
• Geographical Distribution: Low
• Threat Containment: Easy
• Removal: Easy

Damage

• Damage Level: Low

Distribution

• Distribution Level: Low