Niknat is a simple Word Macro virus. It creates a hidden directory called C:\EvaHzg2 and writes a batch file into it. This batch creates a bitmap file (Evah.bmp) by using debug.exe from DOS.
Disinfection & Removal
Niknat activates on 23rd of October. Then the virus manipulates the registry in order to change the active Wallpaper to a new one. This new Wallpaper is the previously creates Evah.bmp which contains a picture of a naked girl.
Niknat contains the 6 macros:
Evahzg AutoClose ToolsMacro FileTemplates TCloseAN DCloseAN
Any attempt to use Tools/Macro or File/Templates menu causes the computer's speaker beep while a message box with this text appears on the screen:
Windows Protection Error
The virus body contains the following text which is never displayed:
by NAENBGOURSG SO.HT.AI.KS 231076-GREECE Thanks to NEURO VRD 19-4-1997 VRP A.U.A
Technical Details: Katrin Tocheva, Peter Szor and Urmas Rahu, F-Secure, 1997