Classification

Category :

Malware

Type :

Virus

Platform :

W97M

Aliases :

Niknat, Evah

Summary

Niknat is a simple Word Macro virus. It creates a hidden directory called C:\EvaHzg2 and writes a batch file into it. This batch creates a bitmap file (Evah.bmp) by using debug.exe from DOS.

Removal

Based on the settings of your F-Secure security product, it will either move the file to the quarantine where it cannot spread or cause harm, or remove it.

A False Positive is when a file is incorrectly detected as harmful, usually because its code or behavior resembles known harmful programs. A False Positive will usually be fixed in a subsequent database update without any action needed on your part. If you wish, you may also:

  • Check for the latest database updates

    First check if your F-Secure security program is using the latest updates, then try scanning the file again.

  • Submit a sample

    After checking, if you still believe the file is incorrectly detected, you can submit a sample of it for re-analysis.

    Note: If the file was moved to quarantine, you need to collect the file from quarantine before you can submit it.

  • Exclude a file from further scanning

    If you are certain that the file is safe and want to continue using it, you can exclude it from further scanning by the F-Secure security product.

    Note: You need administrative rights to change the settings.

Technical Details

Niknat activates on 23rd of October. Then the virus manipulates the registry in order to change the active Wallpaper to a new one. This new Wallpaper is the previously creates Evah.bmp which contains a picture of a naked girl.

Niknat contains the 6 macros:

Evahzg
 AutoClose
 ToolsMacro
 FileTemplates
 TCloseAN
 DCloseAN

Any attempt to use Tools/Macro or File/Templates menu causes the computer's speaker beep while a message box with this text appears on the screen:

Windows Protection Error

The virus body contains the following text which is never displayed:

by NAENBGOURSG
 SO.HT.AI.KS
 231076-GREECE
 Thanks to NEURO
 VRD 19-4-1997
 VRP A.U.A