Niknat is a simple Word Macro virus. It creates a hidden directory called C:\EvaHzg2 and writes a batch file into it. This batch creates a bitmap file (Evah.bmp) by using debug.exe from DOS.
Once detected, the F-Secure security product will automatically disinfect the suspect file by either deleting it or renaming it.
Detailed instructions for F-Secure security products are available in the documentation found in the Downloads section of our Home - Global site.
You may also refer to the Knowledge Base on the F-Secure Community site for further assistance.
Niknat activates on 23rd of October. Then the virus manipulates the registry in order to change the active Wallpaper to a new one. This new Wallpaper is the previously creates Evah.bmp which contains a picture of a naked girl.
Niknat contains the 6 macros:
Evahzg AutoClose ToolsMacro FileTemplates TCloseAN DCloseAN
Any attempt to use Tools/Macro or File/Templates menu causes the computer's speaker beep while a message box with this text appears on the screen:
Windows Protection Error
The virus body contains the following text which is never displayed:
by NAENBGOURSG SO.HT.AI.KS 231076-GREECE Thanks to NEURO VRD 19-4-1997 VRP A.U.A
Technical Details:Katrin Tocheva, Peter Szor and Urmas Rahu, F-Secure, 1997