1. Symantec/
  2. Security Response/
  3. W2K.Stream


Risk Level 1: Very Low

September 5, 2000
February 13, 2007 11:32:40 AM
Also Known As:
PE_STREAM.A [Trend], W2K/Stream [McAfee, Sophos], Win2K.Stream.a [Kaspersky], Win2K.Stream [Computer Associa
Systems Affected:

W2K.Stream virus was discovered in early September 2000. The virus was created by Benny and Ratter of the 29A virus group. This virus is a proof-of-concept virus that utilizes NTFS streams and has received much attention. It is a new subclass of the traditional companion virus and is now being referred to as the "Stream Companion" virus.

W2K.Stream virus only infects files on Windows 2000 using NTFS, and only the files in the same directory. The infected files will become 3,628 bytes in size regardless of the original file size because the original host file is replaced by the virus and stored in a different stream.

As of September 7, 2000, Symantec AntiVirus Research Center has received no reports of this virus in the wild, and it is considered a very low threat.

Antivirus Protection Dates

  • Initial Rapid Release version September 5, 2000
  • Latest Rapid Release version March 23, 2017 revision 037
  • Initial Daily Certified version September 5, 2000
  • Latest Daily Certified version March 23, 2017 revision 041
  • Initial Weekly Certified release date September 5, 2000
Click here for a more detailed description of Rapid Release and Daily Certified virus definitions.
Writeup By: Peter Szor

Search Threats

Search by name
Example: W32.Beagle.AG@mm
STAR Antimalware Protection Technologies
2016 Internet Security Threat Report, Volume 21
  • Twitter
  • Facebook
  • LinkedIn
  • Google+
  • YouTube