Nygus is a resident file virus which infects both COM and EXE files.

Automatic action

Based on the settings of your F-Secure security product, it will either move the file to the quarantine where it cannot spread or cause harm, or remove it.

Suspect a file is incorrectly detected (a False Positive)?

A False Positive is when a file is incorrectly detected as harmful, usually because its code or behavior resembles known harmful programs. A False Positive will usually be fixed in a subsequent database update without any action needed on your part. If you wish, you may also:

  • Check for the latest database updates

    First check if your F-Secure security program is using the latest detection database updates, then try scanning the file again.

  • Submit a sample

    After checking, if you still believe the file is incorrectly detected, you can submit a sample of it for re-analysis.

    NOTE If the file was moved to quarantine, you need to collect the file from quarantine before you can submit it.

  • Exclude a file from further scanning

    If you are certain that the file is safe and want to continue using it, you can exclude it from further scanning by the F-Secure security product.

    Note You need administrative rights to change the settings.

For more Support

Knowledge Base

Find the latest advice in our Community Knowledge Base.

User Guide

See the user guide for your product on the Help Center.

Contact Support

Chat with or call an expert for help.

Submit a sample

Submit a file or URL for further analysis.

Technical Details

When infected file is executed for the first time, virus will install itself in memory and reserves 1024 bytes for itself. At this time the virus will also hook interrupt 21h.

The int21 handler intercepts calls to DOS function 4B00h (loadexec). The read-only attribute is cleared if set, but not restored afterwards. Infection is only attempted if at least 1 cluster is available on the default drive. Files matching COMM*.*, MKS_*.*, COS_*.* or MKMM*.* are not infected. These files include some antivirus programs and DOS' command interpreter COMMAND.COM.

Virus infects all EXE files which are not already infected and are between 768 bytes and 192 kilobytes. Virus infects all uninfected COM files which are longer than 640 bytes. Virus contains an encrypted text message saying '(c)Nygus v2.0'. The text is not used anywhere by the virus.

There is one known 752 byte variant of this virus.