Welcome to the Virus Encyclopedia of Panda Security.
It changes the home page of Internet Explorer, modifies the default name of the browser window, opens NotePad one thousand times and deletes and modifies files.
|Detection updated on:||May 12, 2009|
GaScript.D is a worm that reaches computers in an e-mail message written in Spanish that is easy to recognize as its subject is extassis and the attached file is called EXTASSIS.VBS.
GaScript.D affects computers when the attached file is run. Then it carries out a series of dangerous actions, such as:
- It infects all the files with an HTM extension that it finds.
- It opens the NotePad program one thousand times, which will probably cause the computer to block.
- It deletes image files with a JPG or BMP extension.
GaScript.D is easy to recognize as it always reaches computers in an e-mail message written in Spanish with the subject extassis and an attached file called EXTASSIS.VBS.
When GaScript.D activates, it displays the following message on screen:
Other symptoms that indicate the presence of GaScript.D in a computer are:
- The home page of Internet Explorer changes to:
HTTP:// WWW.ES.GEOCITIES.COM/ ELGRANPALOMOBALTANAS.
- The default name of the Internet Explorer window changes to:
EXTASSIS SE HA APODERADO DE TU PC
- Image files (with a JPG or BMP extension) disappear.
- The NotePad program is opened one thousand times.