Threat Description

Niknat

Details

Aliases: Niknat, Evah
Category: Malware
Type: Virus
Platform: W97M

Summary



Niknat is a simple Word Macro virus. It creates a hidden directory called C:\EvaHzg2 and writes a batch file into it. This batch creates a bitmap file (Evah.bmp) by using debug.exe from DOS.



Removal



Automatic Disinfection

Allow F-Secure Anti-Virus to disinfect the relevant files.

For more general information on disinfection, please see Removal Instructions.



Technical Details



Niknat activates on 23rd of October. Then the virus manipulates the registry in order to change the active Wallpaper to a new one. This new Wallpaper is the previously creates Evah.bmp which contains a picture of a naked girl.

Niknat contains the 6 macros:

Evahzg
        AutoClose
        ToolsMacro
        FileTemplates
        TCloseAN
        DCloseAN

Any attempt to use Tools/Macro or File/Templates menu causes the computer's speaker beep while a message box with this text appears on the screen:

Windows Protection Error

The virus body contains the following text which is never displayed:

by NAENBGOURSG
        SO.HT.AI.KS
        231076-GREECE
        Thanks to NEURO
        VRD 19-4-1997
        VRP A.U.A





Technical Details: Katrin Tocheva, Peter Szor and Urmas Rahu, F-Secure, 1997


SUBMIT A SAMPLE

Suspect a file or URL was wrongly detected? Submit a sample to our Labs for analysis

Submit Now

Give And Get Advice

Give advice. Get advice. Share the knowledge on our free discussion forum.

Learn More