Threat Description



Category: Malware
Type: Virus
Platform: W97M
Aliases: Niknat, Evah


Niknat is a simple Word Macro virus. It creates a hidden directory called C:\EvaHzg2 and writes a batch file into it. This batch creates a bitmap file (Evah.bmp) by using debug.exe from DOS.


Automatic action

Once detected, the F-Secure security product will automatically disinfect the suspect file by either deleting it or renaming it.

More scanning & removal options

More information on scanning or removal options is available in the documentation for your F-Secure security product on the Downloads section of our Home - Global site.

You may also refer to the Knowledge Base on the F-Secure Community site for more information.

Contact Support

For further assistance, F-Secure customers can request support online via the Request support or the Chat forms on our Home - Global site.

Technical Details

Niknat activates on 23rd of October. Then the virus manipulates the registry in order to change the active Wallpaper to a new one. This new Wallpaper is the previously creates Evah.bmp which contains a picture of a naked girl.

Niknat contains the 6 macros:

Evahzg         AutoClose         ToolsMacro         FileTemplates         TCloseAN         DCloseAN  

Any attempt to use Tools/Macro or File/Templates menu causes the computer's speaker beep while a message box with this text appears on the screen:

Windows Protection Error  

The virus body contains the following text which is never displayed:

by NAENBGOURSG         SO.HT.AI.KS         231076-GREECE         Thanks to NEURO         VRD 19-4-1997         VRP A.U.A  

Technical Details:Katrin Tocheva, Peter Szor and Urmas Rahu, F-Secure, 1997


Suspect a file or URL was wrongly detected? Submit a sample to our Labs for analysis

Submit Now

Give And Get Advice

Give advice. Get advice. Share the knowledge on our free discussion forum.

Learn More