Ms. Zhang of Jiang Min Company told the reporter that during the Spring Festival, the customer service staff of the company received many calls for help about the "panda burning incense" virus, and some computer users were infected with the virus during the Spring Festival. At present, in addition to more than 700 previously discovered "Panda Burning Incense" virus variants, new virus variants have emerged. Jiang Min Company continues to detect the trend of "Panda Burning Incense" virus according to the requirements of the public security department.
Special tips
Anti-virus experts in Jiang Min remind users that in the first few days after the Spring Festival, they should pay attention to upgrading anti-virus software in time, updating the virus database of anti-virus software, starting the real-time monitoring function of anti-virus software, installing system patches in time, and killing viruses in the whole enterprise LAN. "The latest variant of panda incense burning virus can also be killed by Jiang Min's upgraded antivirus software."
Ye Tieguan, deputy director of the Public Security Bureau of Xiantao City, Hubei Province, who is responsible for investigating the case of "Panda Burning Incense" virus, said that Li Jun, the maker of "Panda Burning Incense" virus, has written a special killing program, and the public security department is organizing experts to identify this program. It is expected to be published online within one week for free download by netizens. According to reports, Li Jun told the police that he first wrote the virus at the request of netizens to "make it interesting". Later, he saw a large number of infected computers, and online public opinion angrily denounced that "things were getting too big". He made up a killing program and wanted to kill all the viruses, but he was afraid to edit it and hang it online for fear that the police would use it as a clue to find him.
The network supervision department of Xiantao Public Security Bureau conducted a preliminary test by using Li Jun's special killing program, and the results showed that the program could completely kill the "Panda Burning Incense" virus and its variants.
Detective record
Tracking "Wuhan Boy" on the Internet to Find out the case owner of "Panda Burning Incense"
If you fail to find a job, vent your dissatisfaction and "make drugs" for profit.
From June, 5438 to February, 2006, a mysterious new virus broke out on the Internet on a large scale, and many enterprise LANs, Internet cafes and personal computers were hit hard. On every computer infected with the virus, rows of panda patterns will appear on the screen. Anti-virus engineers named it Nimia. From mid-June 5438 to February 2006, "Panda Burning Incense" entered a period of rapid mutation. On June 7 this year, at 65438, the National Computer Virus Emergency Response Center issued an emergency warning of "panda burning incense". On June 9, 2007, the Public Security Bureau of Xiantao City, Hubei Province received a report that the "Jianghan Hotline" in this city was unfortunately infected with the "Panda Burning Incense" virus, resulting in network paralysis. "Panda" officially entered the police field of vision. 65438+ 10 In mid-October, the Network Supervision Corps of Hubei Provincial Public Security Department began to investigate the producers of "Panda Burning Incense" according to the deployment of the Public Information Network Security Supervision Bureau of the Ministry of Public Security. According to the investigation, the virus author added the code "WHBOY" (Wuhan boy) to the virus. Therefore, the police suspect that the author of the virus may be a person named "Wuhan Boy". After preliminary verification, Xiantao Network Supervision Brigade officially put on file on124, and named it "1 22" to produce and spread computer viruses. The Ministry of Public Security and Hubei Provincial Public Security Department attached great importance to this case and demanded that the network supervision department win the lawsuit at all costs. On the afternoon of June 365438+1 October 3 1, the provincial public security department dispatched six elite network supervisors from Wuhan, Yichang and Jingmen, and the National Computer Virus Emergency Response Center specially dispatched1expert. The whole team of Xiantao Network Supervision Brigade gathered in the provincial public security department to conduct a "consultation" on the "June 22" case and was established. Under the unified deployment of the Network Supervision Corps of the Provincial Public Security Department, the network police in Xiantao City used various network technical means and investigation means to obtain the identity information of the suspect "Wuhan Boy". Page 1 try showad (3,0,1); Capture (ex)
Caught in the process of absconding.
"Wuhan boy" is also known as "Xiaojun" and the net name is "Dave". According to Xiaojun's online account, the police locked in a man named Luo, who lives in a residential building in Guanshan, Wuchang.
The police found on the scene that this place is a rental house, and Luo rented a three-bedroom apartment on the second floor. Now he lives with Luo, his girlfriend and someone he calls "the master". According to the description of the owner and the photos of the suspects held by the police, the staff of the special class determined that Master Luo was a "small army".
The Network Supervision Corps of the Provincial Public Security Department held an emergency special meeting and formulated a careful arrest plan and interrogation plan.
At about 4 pm that day, the police arrested Xiaojun's younger brother Li Ming in the rental house. According to his account, Xiaojun's real name is Li Jun.
At about 5 pm, the police learned during the investigation that the suspect had to flee the scene. The Network Supervision Corps of the Provincial Public Security Department immediately issued an investigation report to the export-import banks. At about 7 pm, Li Jun, who went back to the rental house to get something to abscond, was caught red-handed. The police found the key card of Wuchang Kyoto Tower Hotel from Li Jun, and the staff of the task force rushed to the hotel overnight and arrested their partner Lei Lei.
In 2003, he began to "edit drugs"
Li Jun, 25, is from Yangluo Street, Xinzhou District, Wuhan. After graduating from technical secondary school, I took part in the vocational training course of network technology and worked in a computer city. Lei Lei, a 25-year-old colleague, is a fellow countryman and classmate, and they have a good relationship.
After graduating in 2004, Li Jun went to Beijing, Guangzhou and other places to find IT jobs many times, especially network security companies, but all failed. In order to vent his dissatisfaction and make money, Li Jun began to write viruses. In 2003, I wrote "Wuhan Boys" virus, and in 2005, I wrote "Wuhan Boys 2005" virus and "QQ Tail" virus.
Li Jun confessed that he wrote the "Panda Burning Incense" virus on June 65438+1October 65438+June 2006. This is a super virus. The infected computer will attach the virus to all web files on the hard disk, and portal websites such as Tianya Community have been attacked by it.
"Panda Burning Incense" not only has all the characteristics of the virus, but also has a strong commercial purpose: it can secretly steal users' game accounts and QQ accounts for sale for profit; You can also control the infected computer, turn it into a "cyber zombie" and secretly visit some websites that pay for access to traffic, thus making a profit. Some variants also include the pilfer date Trojan (a program that can steal users' passwords and information).
Multi-person rewriting to build a "botnet"
By selling himself or others, Li Jun sold viruses to 1000 people at a price ranging from 500 yuan to1000 yuan each time, making an illegal profit of more than1000 yuan. After the further spread of virus buyers, various variants of the virus spread rapidly and widely on the Internet. It is estimated that there are millions of "botnets" controlled by the "panda burning incense" virus, and they can earn tens of millions of yuan a year by visiting websites that pay for access to traffic.
After Li Junhe Lei Lei was arrested, the police seized Wang Leyan (male, 22 years old, from Weihai, Shandong Province), Ye Peixin (male, 2 1 year old, from Wenzhou, Zhejiang Province), Zhang Shun (male, 23 years old, from Lishui, Zhejiang Province) and Wang Zhe (male, 24 years old, from Xiantao, Hubei Province) and others who rewrote and spread "panda burning incense". These people build a "botnet" by rewriting and spreading the "panda burning incense" virus, and illegally make profits by stealing various games and QQ accounts. Text/Li Shen
Photo: On February 14, Li Jun, the producer of "Panda Burning Incense" virus, was taken out of prison for trial. Xinhua News Agency.
Penitence in prison
I didn't expect the consequences to be serious, so I dare not disclose the anti-virus program.
He graduated from technical secondary school at the age of 25.
14 in the afternoon, when the reporter saw Li Jun, the virus maker of "Panda Burning Incense" in the First Detention Center of Xiantao City, Hubei Province, he felt that he was unremarkable and could not see anything extraordinary.
Li Jun is 25 years old, from Xinzhou District, Wuhan, and graduated from technical secondary school. "I came into contact with computers at 1999, mainly to learn computer knowledge in Internet cafes." Li Jun hung his head and whispered, "At first, I designed this virus just out of curiosity and fun. Later, some netizens asked me to buy a Trojan horse. I think I can make money from this, so ... "
According to the police, in September last year, Li Jun was invited by netizens to produce the "panda burning incense" virus. Since June 5438+February last year, this virus spread wildly on the Internet, causing a panic. Some companies and netizens who suffered heavy losses also issued "wanted orders" to trace the virus makers.
Leave a message on the antivirus software.
Li Jun, height 1.75 meters, shaved his head and wore a yellow vest, slightly decadent. He said: "At first, I didn't expect any consequences. I didn't expect the consequences to be so serious and the matter to be so big. I gradually became afraid, so I later compiled an anti-virus program to kill all the viruses, but I didn't dare to hang it online after editing, for fear that the police would find me. "
According to the police, Li Jun left a message on the anti-virus software: "I am really sorry for the negative impact and loss caused."
I have applied for an IT enterprise in Guangdong.
After graduating from technical secondary school, Li Jun applied for IT companies in Guangdong and other places, but he never got it. Later, Li Jun went to work in Wuhan Computer City with a monthly salary of about 1000 yuan.
After the "panda burning incense" virus appeared, a virus seller in Zhejiang remitted 3,500 yuan to Li Jun's bank account every day, and then remitted 6,000 yuan every day. Until he was caught, he made a profit of hundreds of thousands in less than a month. Li Jun keeps his money in his bank card and seldom goes out to play. The police investigating the case told the reporter that his money was mainly used to meet netizens in other places. According to Xinhua News Agency
Photo: Li Jun tested the virus killing program of "Panda Burning Incense" under the supervision of the police. Xinhua News Agency.
comment
Worried about hacker worship
The detection of "the first major case of computer virus manufacturing in China" has aroused concern. Another meaning of the "China First Case" actually exposed the embarrassment of criminal justice in cracking down on cyber crimes. /kloc-the criminal law was revised 0/0 years ago, and computer crimes were clearly stipulated in three articles, among which article 286 specifically stipulated "deliberately making and spreading computer viruses".
In the past 10 years, we hardly saw this kind of crime enter the public media's field of vision. The reason is not because we didn't intentionally create and spread computer viruses. According to statistics, almost one-third of the computer viruses discovered in the world last year originated from China, among which there were many vicious spreading incidents with great harm. But these crimes have either not been filed or cannot be solved.
Take Li Jun, a 25-year-old "Wuhan boy" suspected of making "pandas burn incense" as an example. Since 2003, he has written "Wuhan Boy" virus and "Wuhan Boy 2005" virus. If Li Jun had been warned four years ago and even been investigated for legal responsibility, there might not be a panda burning incense today. It is this behavior of making and spreading viruses many times that has not been corrected by the judicial department for a long time, which has caused Li Jun's legal ignorance on this issue.
In today's online life, there should be many online teenagers with similar mentality to Li Jun. In an online survey on how to punish Li Jun on a portal website, there is not much difference between netizens who are in favor of letting Dai Li commit crimes and those who are in favor of severe punishment according to law. In all kinds of news comments, posts and replies, many people call Ali a "network wizard", "hacker hero" and "Wuhan hero". The characteristics of computer crime, such as high intelligence and younger age, make many criminals worship rather than be condemned. Such an outcrop against the rule of law is not unrelated to the lateness of the judiciary. (new scene)
statement
Legal experts said that the maker of the "panda burning incense" virus is a typical act of deliberately making and spreading destructive programs such as computer viruses, which affects the normal operation of computer systems and has serious consequences. According to the criminal law, whoever commits this crime and the consequences are serious shall be sentenced to fixed-term imprisonment of not more than five years or criminal detention; If the consequences are especially serious, they shall be sentenced to fixed-term imprisonment of not less than five years.