I found a man named aa. In 2007 1 month, the police of Longhua Mountain Police Station in Xiantao City found that the computer used to handle the second-generation ID card had been poisoned. Even if it is poisoned, it will return to its original appearance. Then, some office computers of the bureau were paralyzed by the "panda burning incense" virus. At the same time, the network supervision brigade of the Municipal Public Security Bureau received a report from the Jianghan Hotline Information Center of Xiantao City that the "Panda Burning Incense" virus appeared in a large area on the central server of the website. The fierce computer virus first appeared in this city, which attracted the attention of the network supervision department of the Municipal Public Security Bureau. Relevant data show that since June 5438+February last year, more than 500,000 computers have been infected and poisoned by the "panda burning incense" virus, and millions of netizens have suffered greatly. The police also found that Rising's security report in 2006 listed "Panda Burning Incense" as the top of 10 virus, and in the top ten viruses reported in Chinese mainland's computer virus epidemic and Internet security report in 2006, the virus became the "king of poison" in one fell swoop. 122, 65438, the network supervision brigade of the Municipal Public Security Bureau reported the case to the public security bureau chief Yu Pinghui, political commissar Li Peigang and deputy director Ye Tieguan. 1October 24th, 65438, the bureau officially put on record for investigation, and named it "1.22" case. The investigation of "Wuhan boy" was listed as a major suspect yesterday. Ye Tieguan, deputy director of Xiantao Public Security Bureau, said that after the case was filed, the municipal network supervision department searched the Internet for relevant information and conducted an analysis and investigation on the computer virus of "Panda Burning Incense". The results show that "Panda Burning Incense" virus is an infectious worm virus, which can infect exe, com, pif, src, html, asp and other files in the system, stop a large number of antivirus software and firewall software processes, and try to read the list of downloaded files from specific websites, and spread quickly through various channels such as web browsing, local area network * * * sharing and USB flash drive. In addition, the infected computer will appear blue screen and restart frequently, and the data files in the system hard disk will be destroyed and the GHO files will be deleted. All exe executable files in the infected user's system have been changed into a panda with three incense sticks. According to the analysis of the characteristics of virus infection and transmission, the network supervision department of the bureau speculated that the author of "Panda Burning Incense" virus was written by a team or someone. Or one person makes it up and many people spread it. The National Computer Virus Emergency Response Center and related information on the Internet show that the computer virus program "Panda Burning Incense" has the signatures of "whboy" and "Wuhan Boy". After the virus infects the webpage file, it will add code to the webpage and redirect the webpage to a specific URL. The registration information of this website shows that the registrant is from Wuhan. Hu and Liu Jie, technicians of the network supervision department, analyzed that the person who mastered all virus codes should be from Wuhan, which is likely to be closely related to Trojans such as "Wuhan Boy" and "QQ Tail" that broke out in 2005. The network supervision department of the Municipal Public Security Bureau decided to investigate in parallel. The network supervision department of the bureau obtained relevant information during the investigation-"WH boy" is famous for the legendary Trojan horse that wrote "Wuhan Boy", and its works are usually signed as "WH Boy" and "Wuhan Boy". As a result, the network supervision department of the Municipal Public Security Bureau listed "Wuhan Boy" as a major criminal suspect and conducted targeted investigations. On June 65438+1October 3 1 day, the "Wuhan boy" was fished out, and under the command and coordination of the Network Supervision Corps of the Provincial Public Security Department, the "65438+1October 22" task force was established. On February 1 day, the task force found out that "Wuhan Boy" shared a room with two other people in Hongshan District, Wuhan. The project investigator pretended to buy antivirus software in Wuhan and fished out a seller. Project police analysis: This seller is "Wuhan Boy". After investigation, the name of "Wuhan Boy" is Li Jun, male, 25 years old, from Yangluo Town, Xinzhou District, Wuhan, and he is proficient in computers. On February 2nd, policemen Zhang, Liu Jie and others rented a HOS house and monitored it for 24 hours. On the afternoon of the same day, the project police studied and implemented the arrest operation, and formulated the arrest plan and interrogation plan. On February 3, the task force analyzed various signs and found that the "Wuhan boy" might have to flee. Arrests must be made in advance. At 8: 40 pm on the 3rd, the police of Xiantao City Network Supervision Brigade waiting in the rental house arrested Li Jun who had returned to the rental house to get something, and inspected the rental house. After a surprise trial, Li Jun confessed that he wrote the "Panda Burning Incense" virus, and the source code of the virus was in the hard disk of a hotel room where he lived with Lei Lei, and admitted to giving a copy of the source code to Lei Lei (male, 25 years old, from Changshan Village, Yangluo Town, Xinzhou District, Wuhan, and Li Jun's classmate). The project police immediately attacked, captured Lei Lei who was about to escape, and seized laptops, hard disks and other items. The National Computer Virus Emergency Response Center identified the extracted source code as the source code of "Panda Burning Incense" virus. Last September, when Li Jun was studying software development in a computer school in Wuhan, he began to make the "panda burning incense" virus. In June+10, 5438, after graduation, Li Jun rented a single room in Hongshan District, Wuhan, and devoted himself to making the "panda burning incense" virus. In the process of writing, he constantly exchanged writing progress with Lei Lei. 165438+ 10, Li Jun wrote the "Panda Burning Incense" virus, and released the news of selling the "Panda Burning Incense" virus through QQ group. About 20 sets of each virus were sold online, and the price was 500- 1000 yuan. This year124, 65438, Lei Lei found Li Jun and told him that the online hype of "panda burning incense" was very powerful and told him to avoid it. On the same day, Li Junhe Lei Lei checked into a hotel in Wuhan to study "panda burning incense" together, and Lei Lei continued to sell 2,000 poisoned "meat machines" for Li Jun online. On February 4th, the Network Supervision Brigade of Xiantao Public Security Bureau inspected the site again and brought Li Junhe Lei Lei back to Xiantao. The Ministry of Public Security organized and coordinated the network supervision departments in Shandong, Zhejiang, Yunnan, Guangdong and Guangxi to monitor and detain the persons and servers involved. On the evening of 5th, Ye Tieguan, deputy director of Xiantao Public Security Bureau, captured Wang Leyan in Weihai, Shandong Province. After preliminary examination, Wang Leyan confessed that he was the person who spread the virus of "Panda Burning Incense" the most, with an average daily income of more than 7,000 yuan, and the income was shared equally with Li Jun. He also confessed two other communicators, one of whom was called "X Fire". With the support of the provincial network supervision corps, Xiantao police learned that it was Xiantao people who claimed to be "X fire". That night, the police arrested "X Fire" at his home (this person's real name is Wang Zhe). Another way to pursue the special class, the suspect Ye Peixin was arrested in Wenzhou, Zhejiang. At this time, Wan, the captain of the network supervision brigade who was collecting servers in Nanchang, drove to Lishui, Zhejiang Province after receiving the notice from the headquarters, and met with the No.3 pursuit class in Lishui, Zhejiang Province. On the evening of 6th, the suspect Zhang Shun was arrested. After the trial, Li Jun was the producer of the "panda burning incense" virus, and the other five were sales communicators, with the aim of making money for fun. Li Jun confessed that the "Panda Burning Incense" virus is a new type of virus "Broiler" which evolved from the combination of various viruses. It is used to control computers, make Trojan horses in computers, steal QQ numbers and game equipment from other people's computers, and sell them for profit after success. Li Jun's maximum income per day reaches 1 10,000 yuan. After six suspects were arrested, the police seized more than 654.38 million yuan of stolen money on the spot, including Wang Leyan who bought a jeep with the stolen money. So far, from February 3 to 10, the network supervision brigade of Xiantao Public Security Bureau has arrested six major suspects in Hubei, Shandong and Zhejiang. (Comprehensive Chutian Metropolis Daily and Wuhan Morning Post) In the eyes of his family, Li Jun's parents have been working in the cement factory in their hometown. They were all fired a few years ago. His mother made a trolley to sell breakfast in the street, and his father worked in a private tile factory. Ms. Chen, a 52-year-old mother, said that Li Jun liked to play computer when he was very young. When he was free, he went to Internet cafes to play, so he bought him a computer and put it at home because he was afraid that he would learn badly outside. Unexpectedly, in the end, her son was arrested by the police for "playing computer", and Ms. Chen felt remorse. Li Jun's father said that when he was four or five years old, Li Jun fell in love with playing with building blocks and disassembling small machinery at home. At that time, Li Jun disassembled all the things that could be disassembled at home, such as radios, alarm clocks, flashlights, etc., and tilted his head to observe each part, then reassembled the parts and restored them to their original state. If the alarm clock moves again or the radio can make a sound, Li Jun will often clap his hands and laugh and celebrate alone for half a day. Li Jun's younger brother Li Ming is three years younger than him. He is a music education major in Southwest University for Nationalities. He went home this winter vacation. He occasionally mentioned to his brother the computer virus "panda burning incense" that he and his classmates had recently caught. After hearing this, my brother changed his previous modesty and smiled disdainfully and said, "This virus is no big deal." At that time, Li Ming didn't think that his brother was the initiator of "Panda Burning Incense". Li Ming told reporters that his brother was excellent in math and English at school. In spite of this, he failed to enter high school, but entered a technical school run by a cement factory (now renamed as "Social Teacher Vocational and Technical School"). Later, after working in a computer city in Wuhan in 2000, I earned money myself, but I rarely gave money to my family. In Li Ming's memory, my brother never asked his parents for money. Someone once told Li Jun that Li Ming is his younger brother and he should give Li Ming some pocket money. Li Jun always said seriously, "You must earn money by yourself! People who can't make money are incompetent. "