Virus Name: Nygus
V Status: Rare
Discovered: August, 1992
Symptoms: .COM & .EXE file growth; file date/time changes; decrease in
total system & available free memory
Eff Length: 757 Bytes
Type Code: PRhA - Parasitic Resident .COM & .EXE Infector
Detection Method: ViruScan, IBMAV, Sweep, AVTK, F-Prot, VAlert,
NAV, NAVDX, PCScan, ChAV,
NShld, Sweep/N, Innoc, AVTK/N, NAV/N, IBMAV/N, LProt
Removal Instructions: Delete infected files
The Nygus virus was received from Poland in August, 1992. This
virus is a memory resident infector of .COM and .EXE programs, but
When the first Nygus infected program is executed, the Nygus virus
will install itself memory resident at the top of system memory but
below the 640K DOS boundary. Total system and available free
memory, as indicated by the DOS CHKDSK program, will have decreased
by 1,024 bytes. Interrupt 21 will be hooked by the virus in
Once the Nygus virus is memory resident, it will infect .COM and
.EXE programs when they are executed. Infected programs will
increase in size by 757 bytes with the virus being located at the
end of the file. The program's date and time in the DOS disk
directory listing will be updated to the system date and time
when infection occurred.
It is unknown what Nygus does besides replicate.
Known variant(s) of Nygus are:
Nygus.278: Received in July, 1995, Nygus.278 is a non-resident
direct action version of the Nygus virus described above. It
infects all of the .COM files, including COMMAND.COM, located
in the current directory when an infected program is executed.
Infected programs will have a file length increase of 278 bytes
with the virus being located at the end of the file. The file's
date and time in the DOS disk directory listing will have been
updated to the current system date and time when infection
occurred. The following text string is visible within the viral
code in all infected files:
Origin: Unknown July, 1995.
Nygus-Klaw: Received in October, 1992, Nygus-Klaw is originally
from Poland. Its size in memory is 1,024 bytes, hooking
interrupt 21. Once it is memory resident, Nygus-Klaw
infects .COM and .EXE programs when they are executed.
Infected programs will have a file length increase of
752 bytes with the virus being located at the end of the
file. The file's date and time in the DOS disk directory
listing will have been updated to the system date and
time when infection occurred. No text strings are
visible in the viral code. Systems infected with
Nygus-Klaw may experience system hangs when some infected
programs are executed, or the user may be returned to the
DOS prompt unexpectedly.
Origin: Poland October, 1992.