Niknat is a simple Word Macro virus. It creates a hidden directory called C:\EvaHzg2 and writes a batch file into it. This batch creates a bitmap file (Evah.bmp) by using debug.exe from DOS.
Based on the settings of your F-Secure security product, it will either automatically delete, quarantine or rename the detected program or file, or ask you for a desired action.
Find the latest advice in our Community Knowledge Base.
See the manual for your F-Secure product on the Help Center.
Submit a file or URL for further analysis.
Niknat activates on 23rd of October. Then the virus manipulates the registry in order to change the active Wallpaper to a new one. This new Wallpaper is the previously creates Evah.bmp which contains a picture of a naked girl.
Niknat contains the 6 macros:
Evahzg AutoClose ToolsMacro FileTemplates TCloseAN DCloseAN
Any attempt to use Tools/Macro or File/Templates menu causes the computer's speaker beep while a message box with this text appears on the screen:
Windows Protection Error
The virus body contains the following text which is never displayed:
by NAENBGOURSG SO.HT.AI.KS 231076-GREECE Thanks to NEURO VRD 19-4-1997 VRP A.U.A