Threat Description

Niknat

Details

Aliases: Niknat, Evah
Category: Malware
Type: Virus
Platform: W97M

Summary


Niknat is a simple Word Macro virus. It creates a hidden directory called C:\EvaHzg2 and writes a batch file into it. This batch creates a bitmap file (Evah.bmp) by using debug.exe from DOS.



Removal


Automatic action

Once detected, the F-Secure security product will automatically disinfect the suspect file by either deleting it or renaming it.

More

Detailed instructions for F-Secure security products are available in the documentation found in the Downloads section of our Home - Global site.

You may also refer to the Knowledge Base on the F-Secure Community site for further assistance.



Technical Details


Niknat activates on 23rd of October. Then the virus manipulates the registry in order to change the active Wallpaper to a new one. This new Wallpaper is the previously creates Evah.bmp which contains a picture of a naked girl.

Niknat contains the 6 macros:

Evahzg         AutoClose         ToolsMacro         FileTemplates         TCloseAN         DCloseAN  

Any attempt to use Tools/Macro or File/Templates menu causes the computer's speaker beep while a message box with this text appears on the screen:

Windows Protection Error  

The virus body contains the following text which is never displayed:

by NAENBGOURSG         SO.HT.AI.KS         231076-GREECE         Thanks to NEURO         VRD 19-4-1997         VRP A.U.A  




Technical Details:Katrin Tocheva, Peter Szor and Urmas Rahu, F-Secure, 1997


SUBMIT A SAMPLE

Suspect a file or URL was wrongly detected? Submit a sample to our Labs for analysis

Submit Now

Give And Get Advice

Give advice. Get advice. Share the knowledge on our free discussion forum.

Learn More