F-Secure Virus Descriptions : Niknat

NAME:	Niknat
ALIAS:	Evah

Niknat is a simple Word Macro virus. It creates a hidden directory called C:\EvaHzg2 and writes a batch file into it. This batch creates a bitmap file (Evah.bmp) by using debug.exe from DOS.

Niknat activates on 23rd of October. Then the virus manipulates the registry in order to change the active Wallpaper to a new one. This new Wallpaper is the previously creates Evah.bmp which contains a picture of a naked girl.

Niknat contains the 6 macros:

        Evahzg
        AutoClose
        ToolsMacro
        FileTemplates
        TCloseAN
        DCloseAN

Any attempt to use Tools/Macro or File/Templates menu causes the computer's speaker beep while a message box with this text appears on the screen:

        Windows Protection Error

The virus body contains the following text which is never displayed:

        by NAENBGOURSG
        SO.HT.AI.KS
        231076-GREECE
        Thanks to NEURO
        VRD 19-4-1997
        VRP A.U.A

[Analysis: Katrin Tocheva, Peter Szor and Urmas Rahu, F-Secure, 1997]