Niknat

Summary

Niknat is a simple Word Macro virus. It creates a hidden directory called C:\EvaHzg2 and writes a batch file into it. This batch creates a bitmap file (Evah.bmp) by using debug.exe from DOS.

Disinfection & Removal

Allow F-Secure Anti-Virus to disinfect the relevant files.

For more general information on disinfection, please see Removal Instructions.

Technical Details

Niknat activates on 23rd of October. Then the virus manipulates the registry in order to change the active Wallpaper to a new one. This new Wallpaper is the previously creates Evah.bmp which contains a picture of a naked girl.

Niknat contains the 6 macros:

Evahzg
        AutoClose
        ToolsMacro
        FileTemplates
        TCloseAN
        DCloseAN

Any attempt to use Tools/Macro or File/Templates menu causes the computer's speaker beep while a message box with this text appears on the screen:

Windows Protection Error

The virus body contains the following text which is never displayed:

by NAENBGOURSG
        SO.HT.AI.KS
        231076-GREECE
        Thanks to NEURO
        VRD 19-4-1997
        VRP A.U.A

Technical Details: Katrin Tocheva, Peter Szor and Urmas Rahu, F-Secure, 1997