Nygus
Nygus
Type File virus
Creator
Date Discovered 1992.08
Place of Origin Poland
Source Language
Platform DOS
File Type(s) .com, .exe
Infection Length 725 bytes
Reported Costs

Nygus is a memory resident file infecting virus from Poland. It appeared in August of 1992. It has a few interesting variants, appearing in the early to mid-1990s.

Behavior

When a file infected with Nygus is executed, it loads itself in memory just below the 640k DOS boundary. The virus reserves 1,024 bytes for itself and hooks interrupt 21 as well as the DOS function 4B00h (loadexec). Nygus infects each .exe and .com file as it is executed. It appends its 725 bytes to the file. It contains the text "(c)Nygus v2.0" encrypted in the virus body, indicating it may not be the original variant, just the first discovered.

Nygus avoids infecting files matching COMM*.*, MKS_*.*, COS_*.* or MKMM*.*, enabling it to avoid COMMAND.COM as well as some antivirus files. It makes no other attempt to hide itself, so the timestamp and file infection length will change adding the infection length to the file size and infection time to the timestamp.

Variants

Around eight known variants of the Nygus virus are known to exist. One appeared in Poland very shortly after the original and another from an unknown location almost three years after the original. As for the others, little is known about their origin, but they are mostly similar to the original with some interesting variations in size.

Nygus.Klaw

This variant appeared in October of 1992, also in Poland. It is 752 bytes long. This version contains bugs that may cause system hangs or unexpected returns to the DOS prompt. It's variant name appears to be a shortened form of "Klawiatura", Polish for Keyboard.

Nygus.278 AKA Nygus.1.1

This version appeared almost three years after the original in July of 1995. This version will infect COMMAND.COM as well as some other files avoided by the original. It contains the string "(c)Nygus v1.1", which is never displayed on the DOS console.

Others

  • Nygus.1.1.227
  • Nygus.1.2
  • Nygus.163
  • Nygus.195
  • Nygus.397

Name

In Polish slang, the word nygus is used to denote a person who shirks work. It can also mean a badly behaved child. It is also the Polish spelling of "Negus" (Amharic: ነጉሥ) formerly the name of the rulers of Ethiopia. "Negus" is also the name of a 17th century British Colonel as well as a mixed drink named after him consisting of port wine, lemon juice and spices.

Sources

Patricia Hoffman. Online VSUM, Nygus Virus.

F-Secure, Nygus.

Laura Boyle. Jane Austen, Negus. 2011.06.17

Miejski, Nygus.

Unless otherwise stated, the content of this page is licensed under Creative Commons Attribution-NonCommercial-ShareAlike 3.0 License