%%File: VIRS0782.TXT
%%Name/Aliases: Urkel,  NWait
%%Platform: PC/MS-DOS
%%Type: Boot sector., 
%%Disk Location: Floppy disk boot sector., Hard disk partition table.
%%Features: Memory resident; TSR above TOM., Stealth
%%Damage: Corrupts hard disk partition table
%%Size: Overlays boot sector, no increase
%%See Also: 
%%Notes: Urkel is a memory resident  MBR infector. It replaces the 
master boot record and moves the partition table, so rebooting with a 
floppy results in an inaccessible hard disk.

the virus uses 1K of ram at the TOM and moves the TOM down.

Do not use FDISK/MBR to fix it, you may loose all your data.

 Writes "URKEL" on screen during the first minute of every hour.

With the virus in memory, Side 0, Track 0, Sector 1 appears to have the 
original MBR. With the virus out of memory, it contains the encrypted 
virus code.

The virus is in Side 0, Track 0, Sector 5