Nygus is a resident file virus which infects both COM and EXE files.
Based on the settings of your F-Secure security product, it will either move the file to the quarantine where it cannot spread or cause harm, or remove it.
A False Positive is when a file is incorrectly detected as harmful, usually because its code or behavior resembles known harmful programs. A False Positive will usually be fixed in a subsequent database update without any action needed on your part. If you wish, you may also:
Check for the latest database updates
First check if your F-Secure security program is using the latest updates, then try scanning the file again.
Submit a sample
After checking, if you still believe the file is incorrectly detected, you can submit a sample of it for re-analysis.
Note: If the file was moved to quarantine, you need to collect the file from quarantine before you can submit it.
Exclude a file from further scanning
If you are certain that the file is safe and want to continue using it, you can exclude it from further scanning by the F-Secure security product.
Note: You need administrative rights to change the settings.
When infected file is executed for the first time, virus will install itself in memory and reserves 1024 bytes for itself. At this time the virus will also hook interrupt 21h.
The int21 handler intercepts calls to DOS function 4B00h (loadexec). The read-only attribute is cleared if set, but not restored afterwards. Infection is only attempted if at least 1 cluster is available on the default drive. Files matching COMM*.*, MKS_*.*, COS_*.* or MKMM*.* are not infected. These files include some antivirus programs and DOS' command interpreter COMMAND.COM.
Virus infects all EXE files which are not already infected and are between 768 bytes and 192 kilobytes. Virus infects all uninfected COM files which are longer than 640 bytes. Virus contains an encrypted text message saying '(c)Nygus v2.0'. The text is not used anywhere by the virus.
There is one known 752 byte variant of this virus.