WarSclerotic

The operators of the highly advanced Flame virus activated a self-destruct mechanism over the weekend, removing any traces of the virus from infected computers they managed to control.

Analysts from security software giant Symantec released a statement saying the virus included a module called Suicide, which could have enabled the virus to delete itself. However, it was a different module, browse32.ocx, that was activated to perform the self-delete. According to the analysts, browse32.ocx was downloaded onto the infected computers only recently — its most recent version is dated May 9.

“It locates every file on the disk, removes it, and subsequently overwrites the disk with random characters to prevent anyone from obtaining information about the infection. This component contains a routine to generate random characters to use in the overwriting operation. It tries to leave no traces of the infection behind,” one analyst said.

The writing of random characters prevent any possible trace and recovery of the deleted file. Normally, when Windows deletes data it does not actually erase it, but instead marks it as free to be written over; it is only actually deleted when something is written over it. This means that recovery programs can often restore deleted data.

The browse32.ocx function erases the contents of files and then writes a sequence of random characters in their place to thwart any form of recovery.

After being exposed in May, the Flame virus was referred to as the most advanced virus of all time by analysts at cyber security firm Kaspersky.

Various media outlets claimed that a virus of that level of sophistication could not be engineered by a group of hackers, but was a product of a government-backed project.

One senior Kaspersky analyst said earlier this month that Flame was “20 times more advanced” than Stuxnet, the cutting-edge virus that managed to sabotage centrifuges in Iran’s nuclear facilities last year and was also suspected of having been developed with government backing.

After talks between International Atomic Energy Agency and Iranian officials ended in failure last week, agency chief Yukiya Amano said on Saturday that he “can’t be in an optimistic mood” concerning a third round of talks in Moscow between six Western powers and Iran scheduled for June 18-19.

On Friday, the U.N. nuclear agency failed to coax Iran into allowing it to reopen a long-dormant probe of suspicions that Tehran worked secretly on atomic arms, further burdening the atmosphere ahead of the Moscow talks.

The IAEA’s investigation has been stalled by Iran’s insistence that the allegations are based on forged U.S. and Israeli intelligence. The six powers — the U.S., Russia, China, Britain, France and Germany — had been watching the outcome of the agency talks in Vienna closely for signs of Iranian flexibility.

But the day-long meeting broke up without agreement, and IAEA negotiator Herman Nackaerts said Iran came to the table with new conditions instead of signing off on a previous draft. “There has been no progress … this is disappointing,” Nackaerts told reporters, adding that no date for a new meeting had been agreed upon.

Iranian envoy Ali Asghar Soltanieh said “there is no obstacle” to a future deal. But the inconclusive meeting fell far short of expectations raised by Amano, who cited the Iranian side late last month as assuring him that agreement was near.

Resumption of the investigation has gained urgency in recent months because of IAEA concerns about a site it suspects was used to test ways of setting off a nuclear charge with high explosives.

The agency late last month showed IAEA board member nations satellite images indicating a cleanup of the site, saying the photos depicted water streaming out of one building, the razing of several other buildings and removal of earth at the facility.

Such activities at the Parchin military base southeast of Tehran are a recent IAEA concern, but Iran’s stonewalling of requests of access to sites, scientists and documents the agency says are linked to dozens of suspected cases of secret nuclear weapons work goes back to 2007.

In an interview with the Wall Street Journal, Amano said not only was there no progress in IAEA talks with Iran, but there were actually some points of regression.

The talks went on for more than five hours and IAEA officials said that as time passed, the tone became more and more belligerent and the sides could not come to an agreement on the scope of U.N. inspector supervision at Iranian nuclear facilities.

The talks were meant as preparation for the next round of negotiations between representatives of the U.S., Russia, China, Britain, France and Germany on one side, and Iranian representatives on the other, and while Amano did not say they were a total failure, he did express concern that Iran had reneged on its apparent willingness to sign an agreement with the IAEA and that he and the agency will be reassessing the situation in light of Iran’s about-face.

Officials in Washington also expressed dismay at the possibility of progress in the upcoming talks in Moscow. Robert Wood, chief U.S. delegate to the IAEA, said on Saturday, “The results of the talks once again emphasize Iran’s inability to fulfill its commitments.”

Ismail Kowsari, deputy chairman of Iran’s Majlis Committee on National Security and Foreign Policy, went one step further on Saturday and said, “The talks in Moscow will fail for sure. The powers are behaving like bullies in the negotiations and we will not cave in to their pressure.”

After supporting the Iranian position unequivocally throughout talks with the West, Iran’s staunch ally, China, seemed to have joined the chorus of countries urging Iran to be more forthcoming over the weekend. At a meeting in Beijing between Chinese President Hu Jintao and Ahmadinejad, Jintao urged the Iranian president to be more “flexible and pragmatic” in the negotiations.

In talks that began in Istanbul in April, the West has presented a proposal, offering a mix of incentives if Tehran reduces uranium enrichment, which can generate weapons-grade material as well as nuclear fuel.

International attention is focused on Iran’s uranium enrichment work, particularly its decision last year to start enriching to a level that can be turned quickly into the core of nuclear missiles. The six powers are seeking to coax Tehran into stopping this activity, but the Islamic Republic says it needs to continue higher-grade enrichment to 20 percent to power a research reactor and to make medical isotopes.

Iran denies any interest in nuclear weapons and wants the international community to ease sanctions before it makes a move, something the Western nations are unwilling to do. Instead, they are offering spare parts for Iran’s aging commercial airline fleet and other goods restricted by sanctions.

An Iran armed with nuclear weapons is considered a threat. Israel has indicated readiness to attack Iran if diplomacy and sanctions fail. The U.S. has said it wants to keep “all options” on the table. Both suspect that Iran is aiming to build nuclear weapons, and Israel believes it would be a prime target.

But the letters show little progress in bridging differences less than two weeks before the Moscow talks and before sanctions are tightened still further on Iran’s oil. The U.S already has started to enforce penalties against countries importing Iranian crude, and the 27-nation European Union, which recently accounted for 18 percent of Iran’s oil shipments, plans to begin an oil boycott July 1.

Comments posted Friday by Iranian President Mahmoud Ahmadinejad on his website suggested a tough line by Tehran ahead of the Moscow talks. “If Iran wants to build an atomic bomb, it doesn’t fear anyone and will publicly announce it and no one will be able to prevent it,” Ahmadinejad wrote, while insisting that Iran had no intention of building nuclear weapons.