New Wiper Virus Targets Iranian Computers

RT.com

Iran has been subjected to another attack by a virus capable of wiping the data on infected PCs. Antivirus experts suggest the virus has been active for at least two months and expect the next attack to take place during January, 2013.

Iran’s Maher Computer Emergency Response Team Coordination Center has issued a warning, cautioning that the new malware continuously erases data from the hard disk drives, despite the simplicity of design and functionality, as it slips into the PC without being detected by the antivirus and anti-malware programs.

The Maher Center said the malware’s installer, also known as the dropper, is called GrooveMonitor.exe, believed to be named that way as a disguise associated with a legitimate Microsoft Office 2007 document feature called Microsoft Office Groove.

Dubbed the Batchwiper, the virus erases drive partitions starting with the letters D through I on Windows operating system, in addition to files stored on the user’s desktop.

The new found threat starts its destruction activities on certain dates, the next one being January 21, 2013. Experts from Symantec suggest that the virus has been active for the last two months as dates going back to October 12 were discovered in the malware’s configuration.

Read More: New Wiper Virus Targets Iranian Computers