The W97M/Niknat.A virus was first listed as 'In The Wild' on The WildList in November 1998.
W97M/Niknat.A infects Word 95 documents. W97M/Niknat.A consists of the macros EVAHZG, TCLOSEAN, AUTOCLOSE, TOOLSMACRO and FILETEMPLATES.
This macro virus will infect Word's NORMAL.DOT file. This macro virus does not disable macro virus protection.
W97M/Niknat.A will cause the system speaker to beep and a message is displayed whenever Tools|Macro or File|Templates. is selected.
As part of its process, W97M/Niknat.A creates the file C:\WINDOWS\COMMAND\EVAH.NIK, C:\WIN95\COMMAND\EVAHZ.BAT, and the hidden directory C:\EVAHZG2. These files are erased upon termination of the virus. The hidden directory remains.
On October 23, if the user is running Windows95, this virus attempts to set the desktop pattern [to a custom value (a small square-like hatch pattern)] and the wallpaper. However, because of the reliance upon specific preexisting subdirectories, the wallpaper assignment does not occur. The failure does not stop the virus from replicating.
WM/Niknat.A contains the following strings, which are never displayed:
'Thanks to NEURO
'VRP A.U.A (+.-.-)