Why do pandas burn incense?

Who shot "Panda Burning Incense"? What does he want? During the period when "Panda Burning Incense" was raging, there were various speculations about the identity of the author on the Internet. In Baidu's "Panda Burning Incense" Post Bar, hundreds of netizens who suffered from "Panda Burning Incense" posted "Wanted" virus makers, and some netizens claimed to offer a reward of 654.38+10,000 US dollars.

Yesterday, the anti-virus engineer revealed to reporters that the author of "Panda Burning Incense" did not disappear without a trace. In the process of dissecting the virus, they found some mysterious information left in the virus. In these messages, the author of "Panda Burning Incense" calls himself WHBOY-"Wuhan Boy".

There is information hidden in the body of "Panda".

Mopery is the moderator and anti-virus expert of Kaka community anti-virus forum. From mid-June, 5438+October, 2006/kloc-0, mopery received help from netizens. In the process of helping to solve the computer fault, he got a virus sample, which is the original version of "Panda Burning Incense". After "dissecting" the virus, in the complicated program code, mopery saw a piece of information unrelated to the program, including a line of letters: "whboy".

The name "whboy" has an unusual meaning for virus researchers. In 2004, whboy released its virus "Wuhan Boy", which is a kind of pilfer date trojan spread through QQ. A year later, due to its madness and wide spread, it was listed as one of the top ten viruses in 2005 by Jiang Min Anti-virus Center. Since then, whboy has posted on some virus forums and hacker forums, claiming that it can provide the service of stealing QQ numbers, but it soon disappeared until "Panda" appeared. Mopery made a detailed analysis of "panda burning incense". He found that this virus does not have the most powerful technology, but it has the most mature means of transmission. Mopery became interested in "panda burning incense". He contacted another farmer, who is an anti-virus expert. On June 25th, 2006, the first killing tool, Nimya Worm Killing, was launched.

"The first panda had no power, but the later varieties were very powerful." MoPerry said that after the first edition of "Panda Burning Incense" was discovered, its varieties reached more than a dozen within one month. In these variants, every once in a while, the author intentionally left the word whboy in the virus. "He mainly shows us people who analyze viruses, and ordinary users can't see the code." With the increase of varieties, anti-virus people began to look forward to more news while dissecting the virus.

The virus lists "confirmation units"

/kloc-in early February of 0/6, the variety of "Panda Burning Incense" accelerated. In addition to the word whboy, there is also a line of Chinese characters in the code: "Wuhan boy is infected with downloader." With the increase of varieties, more and more information is attached to the code. At this time, mopery and Emma have joined the army against "panda burning incense". They analyzed the new panda species and released a detailed virus analysis report on Kaka community anti-virus forum. Their actions attracted the attention of the virus author "Wuhan Boy". In a virus variant at the beginning of 65438+ 10, the mysterious message was updated again.

"Thanks to mopery for paying attention to this Trojan horse." This new sentence in the message made Mopery laugh and cry. Subsequently, Wuhan boy seems to be infatuated with the model of "thank you unit" listed in the virus. Emma's name was added to the thank-you list in the virus message of 65438+10.5. 654381Oct.9 Thanks for adding the name "Haiyue" to the list of antivirus experts. The sentence "I am convinced ... Emma ..." at the end of the article has been added.

Since then, Wuhan boys have frequently "communicated" with their opponents in this way. 65438+1October 15, Wuhan boys greeted anti-drug policeman Taylor 77 in a message: "Taylor 77, I wonder what you want to see me about?" And joked: "The virus I made has burned all the national treasures in the city."

Online world experts fight for a month.

16 10/6, Wuhan boys released a new virus variant, which drug addicts used to call "Emma" version. Because in the news of this virus, Emma's name was written 22 times. On the evening of 65438+ 10 19, "Panda Burning Incense" released its last update. This version is the most comprehensive version of infection. In the last version of "Panda Burning Incense", Wuhan boy wrote a farewell message: "I am deeply sorry to the netizens and network administrators who have heard of this Trojan horse! Sorry, you have worked hard! Moping, I really want to talk to you! For some reason, I think I'd better forget it! "

Facing the news that "Panda Burning Incense" stopped updating, Shi Jun, an anti-virus engineer, seemed very calm: "We hope the panda storm will end here, but there is a precedent for Wuhan boys to make a slip of the tongue. In short, as long as he updates, we will accompany him to the end. "

For this Wuhan boy who has been fighting for more than a month, but he doesn't know where to hide, mopery's message is: "I hope he can make good use of his own technology to serve the majority of netizens, instead of bringing pain to netizens."

Nature's ecology has been destroyed, and environmentalists pray for bamboo to have food next year by burning incense with pandas, thus creating this shocking panda burning incense virus to warn the world. "

After that, I was deeply satisfied with my cleverness and couldn't help laughing.

On February 7, 2007, at 2: 35 pm, this article was titled "I am the Wuhan people who make the panda incense burning virus: why make the virus?" Appeared in the IT World section of Aoyi.com Forum. When talking about why the portrait of "panda burning incense" was used, the Wuhan man revealed that he wanted to add a cute little animal, like Rising, to his things. He once considered pigs, cats and pandas, and was inspired by the popular song "Begging for Buddha" and chose pandas. He thinks that "panda is a national treasure, and so is my program."

Source: Nanhui, Qiu Yan, www.backbird.com Original:/dispbs _ 20 _ 305588 _ 6 _ pre.html