Niknat is a simple Word Macro virus. It creates a hidden directory called C:\EvaHzg2 and writes a batch file into it. This batch creates a bitmap file (Evah.bmp) by using debug.exe from DOS.
Depending on the settings of your F-Secure security product, it will either automatically delete, quarantine or rename the suspect file, or ask you for a desired action.
More scanning & removal options
More information on the scanning and removal options available in your F-Secure product can be found in the Help Center.
You may also refer to the Knowledge Base on the F-Secure Community site for more information.
Niknat activates on 23rd of October. Then the virus manipulates the registry in order to change the active Wallpaper to a new one. This new Wallpaper is the previously creates Evah.bmp which contains a picture of a naked girl.
Niknat contains the 6 macros:
Evahzg AutoClose ToolsMacro FileTemplates TCloseAN DCloseAN
Any attempt to use Tools/Macro or File/Templates menu causes the computer's speaker beep while a message box with this text appears on the screen:
Windows Protection Error
The virus body contains the following text which is never displayed:
by NAENBGOURSG SO.HT.AI.KS 231076-GREECE Thanks to NEURO VRD 19-4-1997 VRP A.U.A
Technical Details: Katrin Tocheva, Peter Szor and Urmas Rahu, F-Secure, 1997