I have a panda burning incense. It could be a variant.

This is a wave of computer viruses spreading wildly.

In more than two months, millions of computer users participated in it, and the charming "pandas" bowed their heads and burned incense in an endless stream. It quickly became hundreds of kinds, constantly invading personal computers, infecting portals and destroying enterprise data systems ... After several large-scale outbreaks, "panda burning incense" became a word that many computer users talked about. Rising's 2006 security report listed it as one of the top ten viruses, and the 2006 Chinese mainland computer virus epidemic and Internet security report called it "the king of viruses".

Its spread tortured the network security and triggered a contest between "Tao" and "magic" in the virtual world.

On February 12, this special contest finally came to an end. Hubei Provincial Public Security Bureau announced that the initiator of "Panda Burning Incense" has been arrested and brought to justice. The case was uniformly deployed and supervised by the Ministry of Public Security, and Huang Hong, deputy director of the Provincial Public Security Department, personally commanded it. The Network Supervision Corps of the Provincial Public Security Department specifically organized and coordinated it, and the Xiantao Public Security Bureau was the main investigator. The first major case of computer virus production and dissemination in China was successfully solved!

"Panda Burning Incense" is rampant on the Internet.

From June, 5438 to February, 2006, a mysterious new virus broke out on the Internet on a large scale, and many enterprise LANs, Internet cafes and personal computers suffered heavy losses. This virus spreads in many ways. After being infected by the virus, rows of panda patterns will appear on the computer screen. The panda holds three incense sticks in his hand and bows with his hands folded. Anti-virus engineers named it Nimia.

By the middle of 65438+February, "Panda Burning Incense" entered a period of rapid mutation. On June 7 this year, at 65438, the National Computer Virus Emergency Response Center issued an emergency warning of "panda burning incense".

654381October 9, Xiantao City Public Security Bureau received a report that the "Jianghan Hotline" in the city was unfortunately infected with the "Panda Burning Incense" virus, resulting in network paralysis. Thus, this seemingly loyal "panda" entered the police's field of vision. 5438+ 10 Mid-October, according to the deployment of the Public Information Network Security Supervision Bureau of the Ministry of Public Security, the Provincial Network Supervision Corps began to organize an investigation on the producers of "Panda Burning Incense".

"Panda" has no knowledge of the police intervention, and continues to "burn incense" everywhere, and it is getting worse. 65438+1On October 22nd, the National Computer Virus Emergency Response Center issued an alarm again, and a panda was wanted all over the country to burn incense.

According to the investigation, the virus author added the code of "WHBOY" (Wuhan boy) to the virus, so the police speculated that the virus author might be a person named "Wuhan boy". After preliminary verification, the Network Supervision Brigade of Xiantao City officially filed a case, 65438, on June 24th, and named it "Case of'1.22' making and spreading computer virus".

Follow, follow.

This is the first case of creating a computer virus in China. Huang Hong, deputy director of the Information Network Security Supervision Bureau of the Ministry of Public Security and Hubei Provincial Public Security Department, attached great importance to this and demanded that the Hubei network supervision department win the lawsuit at all costs.

On the afternoon of June 365438+1October 3 1, the provincial public security department dispatched six elites from Wuhan, Yichang and Jingmen, experts specially sent by the National Computer Virus Emergency Response Center, and the police of the network supervision brigade of Xiantao Public Security Bureau gathered in the provincial public security department to discuss the "June 1.22" case and discuss countermeasures. The project reconnaissance leading group and the joint work special class were announced at the same time.

Under the unified deployment of the provincial offices, Xiantao network police used a variety of network technical means and methods to obtain the identity information of the suspect "Wuhan boy". Wuhan boy, also known as Xiaojun, male, about 25 years old, height 1.75 meters, net name Dave. According to the data of Xiaojun's online account, the police locked a man named Luo, who lives in a residential building in Guanshan, Wuchang District, Wuhan. The staff of the special class found that this place was a rental house. Luo rented a three-bedroom apartment on the right side of the second floor. The owner said that this house was rented by Luo in February 2006, and now he lives with Luo, his girlfriend and someone he calls the "owner". According to the description of the owner and the photos of the suspects held by the police, the staff of the special class determined that Master Luo was a "small army"!

On the morning of February 3, the field team responsible for 24-hour monitoring of Xiaojun's home heard that the people in the rental house had not returned overnight. Further investigation by the police found that the suspect had not returned to the rental house for many days. There are indications that criminal suspects may be alert. The Network Supervision Corps of the Public Security Department immediately held an emergency seminar. The staff of the special class repeatedly weighed the current situation and the advantages and disadvantages of arrest. They agreed that it was necessary to arrest the fighter plane immediately so as not to delay it, and made a detailed arrest plan and interrogation plan. Under the command of Deputy Director Huang Hong, the arrest work started rapidly.

On the afternoon of the same day, at about 0/6 o'clock in Kloc-0, the field team captured Xiaojun's younger brother Li in the rental house. According to him, Xiaojun's real name is Li Jun, around 17. The police reconnaissance learned that the suspect was preparing to flee the scene! The network supervision corps immediately issued an investigation report to all import and export ports such as Wuhan airport, railway station and long-distance bus station. /kloc-around 0/9: 00, news came from the working group waiting in the rental house. Li Jun returned to the rental house to get something to abscond and was caught red-handed. The police found a key card of Du Jing Hotel in Wuchang from Li Jun, and the headquarters urgently ordered the mobile arrest special class composed of the network supervision department of Wuhan Public Security Bureau to rush to the hotel, and arrested his partner Lei Lei that night.

"network genius" writes drugs for profit

"He is an internet genius." On June 5438+02, experts from the Provincial Network Supervision Corps described Li Jun like this. The suspect Li Jun is 25 years old this year. He is from Yangluo Street, Xinzhou District, Wuhan. After graduating from technical secondary school, I took part in the vocational training course of network technology and worked in a computer city. Lei Lei, a 25-year-old colleague, is a fellow countryman and classmate, and they have a good relationship.

After graduating in 2004, Li Jun went to Beijing, Guangzhou and other places to find IT jobs many times, especially network security companies, but all failed. In order to vent his dissatisfaction and make money at the same time, Li Jun began to write viruses. In 2003, I wrote "Wuhan Boys" virus, and in 2005, I wrote "Wuhan Boys 2005" virus and "QQ Tail" virus.

Li Jun admitted that he wrote "Panda Burning Incense" on June 65438+1October 65438+June 2006. This is a super virus, and the infected computer will attach the virus to all web files on the hard disk. If the infected computer is a website editor, it may be attached to all pages of the website through a poisoned webpage virus, and netizens will be infected with the virus when visiting the poisoned website. "Panda Burning Incense" has infected portal websites such as Tianya Community. "Panda Burning Incense" not only has all the characteristics of the virus, but also has a strong commercial purpose: it can secretly steal users' game accounts and QQ accounts for sale, and can also control infected computers, turn them into "cyber zombies" and secretly visit some websites that pay for their access, thus making profits. Some varieties also contain pilfer date trojan.

Li Jun sold the virus to more than 1.020 people at a price ranging from 500- 1 10,000 yuan each time, and made an illegal profit of 1 10,000 yuan. After the further spread of virus buyers, various variants of the virus spread widely on the Internet. It is estimated that there are millions of "cyber zombies" controlled by the "panda burning incense" virus. They can earn tens of millions of yuan a year by visiting paid websites.

After Li Junhe Lei Lei was arrested, the police seized Wang Leyan (male, 22 years old, from Weihai, Shandong Province), Ye Peixin (male, 2 1 year old, from Wenzhou, Zhejiang Province), Zhang Shun (male, 23 years old, from Lishui, Zhejiang Province) and Wang Zhe (male, 24 years old, from Xiantao, Hubei Province) and others for rewriting and spreading "panda burning incense".

Legal experts said that the maker of the "panda burning incense" virus is a typical act of deliberately making and spreading destructive programs such as computer viruses, which affects the normal operation of computer systems and has serious consequences. According to the criminal law, whoever commits this crime and the consequences are serious shall be sentenced to fixed-term imprisonment of not more than five years or criminal detention; If the consequences are especially serious, they shall be sentenced to fixed-term imprisonment of not less than five years.

At present, the main suspects have been detained by Xiantao police, and they will be severely punished by law.

In the middle of June 5438+ 10 this year, the network supervision department of the Public Security Bureau of Xiantao City, Hubei Province investigated the producer of the "Panda Burning Incense" virus according to the unified deployment of the Information Network Security Supervision Bureau of the Ministry of Public Security and the Provincial Public Security Department. After investigation, the producer of the panda incense burning virus is Li Jun from Wuhan City, Hubei Province. According to Li Jun's account, he compiled the "Panda Incense Burning Virus" on June 65438+1October 65438+June 2006, and it was widely spread on the Internet. He also sold the virus to more than 120 people online by selling it himself or by others, making an illegal profit of 65438+. After the further spread of virus buyers, various variants of the virus spread in a large area on the Internet, causing serious damage to the computer security of netizens. Li Jun also wrote "Wuhan Boy" virus in 2003, "Wuhan Boy" virus in 2005 and "QQ Tail" virus in 2005. In addition, there are several other important suspects in this case, such as Lei Lei (male, 25 years old, from Xinzhou District, Wuhan City), Wang Leyan (male, 22 years old, from Weihai, Shandong Province), Ye Peixin (male, 2 1 year old, from Wenzhou, Zhejiang Province) and Zhang Shun (male, 23 years old, from Lishui, Zhejiang Province).

At present, five suspects, including Li Jun and Lei Lei, have been criminally detained.

So far, the virus killing tool for "Panda Burning Incense" written by the criminal suspect Li Jun has not been officially released on any website. Please don't download and use blindly. (The tool for killing and killing "Panda Burning Incense" virus compiled by the criminal suspect Li Jun will be released for download on www.xt 1 10.net website after being identified as qualified. )

References:

www.xt 1 10.net