Virus.MSWord.Niknat.i

0 0

This encrypted macro virus contains four macros, it replicates on closing documents (AutoClose):

Documents      NORMAL.DOT
EvaHzg         EvaHzg
AutoClose      DCloseAN
FileTemplates  FileTemplates, ToolsMacro
TCloseAN       AutoClose

On October 23 the virus creates the EVAH.BMP file with a porno-picture image inside in the Windows directory and sets it as the Windows background picture (wallpaper). The virus then also changes Windows color palette.

On entering the File/Templates and Tools/Macro Word menus the virus displays the MessageBox (stealth):

Microsoft Windows
Windows Protection Errorr

The virus also contains the comments, these comments depend on the virus version:

"Niknat.a,b,...":

by NAENBGOURSG
SO.HT.AI.KS
231076-GREECE
Thanks to NEURO
VRD 19-4-1997
VRP A.U.A ( . . )

"Niknat.i":

--------------------------------
Latin word -virus- means poison and is a derivative
of two Sanskritic roots --> -vishas->(poison)
and -ishus->(arrow).
NAENBGOURSG - SO.HT.AI.KS
M.SC. in MacroViral Science
---------------------------------