Virus Name: Urkel
V Status: New
Discovered: January, 1997
Symptoms: Boot Sector Changes; Master Boot Record Altered;
decrease in total system & available free memory;
"invalid drive specification" error; message displayed
Eff Length: N/A
Type Code: BRtX - Resident Boot Sector & MBR Infector
Detection Method: NAV, NAVDX, PCScan, AVTK, ViruScan
Removal Instructions: F-Prot, do NOT us FDisk /MBR to disinfect
The Urkel virus was received in January, 1997. Its origin or point
of isolation is unknown. Urkel is a memory resident infector of
diskette boot sectors and the system hard disk master boot record.
When the system is booted from an Urkel infected diskette, this
virus will become memory resident at the top of system memory but
below the 640K DOS boundary, moving interrupt 12's return. Total
system and available free memory, as indicated by the DOS CHKDSK
program from DOS 5.0, will have decreased by 2,048 bytes. Also at
this time, the virus will infect the system hard disk master boot
record if it has not been previously infected by the virus. Later,
upon booting the system from the system hard disk, the virus will
become memory resident in a similar manner.
Once the Urkel virus is memory resident, it will infect diskette
boot sectors when an un-write protected diskette is accessed on the
system. This virus alters the boot record, and also writes a
portion of the viral code in the last or second to last sector of
the diskette root directory. Since a sector of the root directory
is overwritten, any directory entries which were originally in this
sector will be lost.
The Urkel virus contains the encrypted text string "Urkel", this
string is sometimes displayed on the system monitor.
A note about the Urkel virus: this virus relocates the information
contained in the disk partition table contained in the master boot
record. As a result, attempting to access the hard disk after
booting the system from an uninfected, write-protected system
diskette will result in an "invalid drive specification" error.
Also as a result of this relocation, the FDisk program with the
/MBR option should not be used to replace the master boot record
as the partitioning information is not in its expected location and
all data on the system hard disk may be lost.