Virus Encyclopedia

Welcome to the Virus Encyclopedia of Panda Security.

Natas

 
Threat LevelModerate threat
DamageHigh
DistributionNot widespread

At a glance

Common name:Natas
Technical name:VBS/Natas
Threat level:Low
Type:Virus
Effects:  It overwrites files.
Affected platforms:

Windows 2003/XP/2000/NT/ME/98/95

Detection updated on:Oct. 4, 2001
StatisticsNo
Family:VALENTIN

Brief Description 

    

Natas is a virus that overwrites files in the directory in which the virus is stored.

It is easy to be infected by Natas as it reaches computers through many means: e-mail messages with infected attachments, computer networks, CD-ROMs, Internet downloads, FTP, floppy disks, etc.

Visible Symptoms 

    

An indication that Natas has infected a computer is the following message, which is displayed when the virus generates a random number (1 or 2) and the result is 1:

Seek refuge for Satan holds no mercy for the weak the sick and the unwanted!

Tech details

Effects

Natas has the following effects on the affected computer:

  • It overwrites all the files found in the directory where it is stored with its code.
  • It displays a message on screen.
  • It opens the web browser.

Infection strategy 

Natas follows the infection routine below:

  • It overwrites all the files found in the directory where it is stored with its code.
  • It generates a random number (1 or 2). If the number generated is 1, the virus displays the message mentioned in the section Visible Symptoms.

It creates the following file in the Favourites folder of Windows directory:

  • NATAS.RL, this file adds a link to a web page.Then, it opens the browser at the link inserted by the virus.

Means of transmission 

Natas does not use any specific mean to spread. It can reach computers through the usual means used by viruses: floppy disks, CD-ROMs, e-mail messages with infected attachments, Internet downloads, FTP, etc.

Further Details  

Natas is written in Visual Basic Script programming language.

Solution

See solution