Lifelong Fighting Against Computer Viruses

By Ning Ken

One day in 1996,Wang Jiangmin took a ride in a yellow taxi to Zhongguancun,a technology hub in Haidian District,Beijing,where he was hired to tackle a computer virus.Computers were still in an early stage at that time,and so were computer viruses.No one had ever thought at that point that cyber security could be a lifelong career.

Fighting with Disability

At 3 years old,Wang suffered from polio and lost the use of his legs.He had always believed that disability shouldn’t be a habitual excuse for not fighting in life—it was irrelevant for fighters like Wang.

While most advised against climbing and cycling,he decided to do just that,fighting against his fate.He did everything he was told not to do—and he did even better in some areas than others without a disability.While he certainly earned many bumps and bruises,he had an explosive power and speed that was not only physical,but also intellectual.That intellectual power grew more intense and demonstrative as he got older.When he was only 11 years old and still in grade-4,Wang had already developed the hobbies of assembling gadgets and self-learning science and technology without a teacher.That year,he assembled a dual-band 8-transistor radio,transceiver,and record player.As a result,he earned the nickname of “l(fā)ittle radioman.”

In 1989,Wang started engaging in research and development of software for industrial use.Unfortunately,as the software he developed often contracted viruses,users distrusted that he could develop good software.That year,China defined computer viruses for the first time,but Wang had already discovered the Ping-Pong virus and the Stoned virus.Wang had a very instinctive sensitivity; he couldn’t help but think that while he could not remove the poliomyelitis virus from his own body,could he destroy viruses in machines?Could it be that viruses,both in his body and on computers,were his fated lifelong struggle? With these questions in mind,he decided to devote all his efforts to the fight against computer viruses.

Wang first used Debug to identify viruses manually,and then wrote a program to wipe out viruses in the 1990s.The first virus that he programmed to remove was the 1741 virus.Every time he removed a virus,he published an article in newspapers and announced his anti-virus program.As time went by,Wang had written more and more anti-virus programs.However,he felt that these separate anti-virus programs were very troublesome to operate,so he integrated six anti-virus programs into one,and named it KV6.It was later developed into a series,including KV8,KV12,KV18,and KV20.

1996年，王江民打了一輛黃色“面的”來(lái)到中關(guān)村，開(kāi)始對(duì)計(jì)算機(jī)病毒展開(kāi)攻擊。計(jì)算機(jī)當(dāng)時(shí)還是新事物，計(jì)算機(jī)病毒更是，沒(méi)人想到有人對(duì)病毒進(jìn)行無(wú)情攻擊。

反殘疾而行

王江民3 歲時(shí)患小兒麻痹癥，腿部殘疾。

殘疾不應(yīng)是一種思維，要反殘疾而行。

有人說(shuō)，腿不好不能爬山，他偏喜歡爬山；不能學(xué)騎自行車(chē)，他偏要騎。不能干什么偏干什么，有些項(xiàng)目甚至比常人干得還好。他常常摔得鼻青臉腫，眼冒金星，但是某種爆發(fā)力與速度驚人。不僅身體上，智力上的反對(duì)顯得更加激烈。還在上小學(xué)四年級(jí)時(shí)，年僅11 歲的王江民就無(wú)師自通，攢出了雙波段8 個(gè)晶體管的收音機(jī)、無(wú)線電收發(fā)機(jī)，以及電唱機(jī)，是20 世紀(jì)60年代初的小無(wú)線電人兒。

1989年，王江民從事工控軟件開(kāi)發(fā)，他開(kāi)發(fā)的軟件因?yàn)槌３８腥静《径箼C(jī)器不能正常工作，用戶就認(rèn)為他開(kāi)發(fā)的軟件不行。那一年國(guó)內(nèi)首次報(bào)道界定了病毒，而在此之前王江民就發(fā)現(xiàn)了“小球”和“石頭病毒”。王江民有種本能的敏感，自身的病毒解決不了，機(jī)器上的病毒也解決不了嗎？難道病毒是自己一輩子的宿命？帶著這種心理，他使出渾身解數(shù)向病毒開(kāi)戰(zhàn)。

王江民先是用Debug 手工殺病毒，然后是寫(xiě)一段程序殺一種病毒。這時(shí)已進(jìn)入20 世紀(jì)90年代，王江民第一次編程序殺的病毒是1741病毒。每殺一種病毒他就在報(bào)刊上發(fā)表一篇文章，公布這段殺毒程序。殺毒程序?qū)懚嗔?，王江民覺(jué)得這些各自獨(dú)立的殺毒程序用起來(lái)很麻煩，就把6 個(gè)殺不同病毒的程序集成到一起，命名為KV6，后來(lái)發(fā)展到KV8、KV12、KV18、KV20。

王江民的KV 系列殺毒軟件雖然兇猛，但也和其他殺毒軟件一樣存在反應(yīng)滯后的問(wèn)題。當(dāng)病毒剛出現(xiàn)尚未蔓延開(kāi)來(lái)，能不能在報(bào)紙上一個(gè)星期公布一次新病毒特征碼，讓KV 用戶自己升級(jí)？這接近防疫措施。王江民將自己的病毒防疫想法連同開(kāi)放式、可擴(kuò)充的KV100 軟件一起寄給《軟件報(bào)》，還為它起了個(gè)名字叫“超級(jí)巡警”?！盾浖?bào)》認(rèn)為這是一個(gè)很好的想法，1994年7月15日首次發(fā)布了《反病毒公告》。

KV100 在《軟件報(bào)》上一炮打響，在沒(méi)有互聯(lián)網(wǎng)和光盤(pán)傳播的時(shí)候，報(bào)紙的《反病毒公告》發(fā)揮了巨大作用。很多單位的主管要求計(jì)算機(jī)管理員把每一期報(bào)紙上的《公告》都剪下來(lái)，把新病毒特征碼加上去。王江民如同防疫站的首席科學(xué)家，聲名鵲起，令人信賴(lài)。

Although Wang’s KV series of anti-virus software functioned strongly and robustly,they suffered the shortcoming of lagging response,as with all antivirus software.He then came up with a countermeasure code that worked on viruses that had not yet spread—if he could publish the new virus attribute code in newspapers once a week,then users could upgrade their KVs themselves.This countermeasure seemed like an epidemic prevention measure.Wang sent his anti-virus ideas together with his open and expandable KV100 design to a newspaper called“Software Weekly,” and named his anti-virus software the “Anti-Spyware Toolkit.”Software Weeklythought highly of his idea and published an “Anti-Virus Bulletin” for the first time on July 15,1994.

KV100 was a hit inSoftware Weekly.In a time when the Internet had not come into being and there was a lack of CDROMs in China,the newspaper’s“Anti-Virus Bulletin” played a big role.In many companies and organizations,directors even required their computer managers to keep up with the posts from every issue of the newspaper and update new virus attribute codes from time to time.Wang Jiangmin,like a chief scientist at an epidemic prevention station,rose to fame and became a trusted name in the field.

March into Zhongguancun

When Wang Jiangmin first contacted Huaxing Company through a friend’s introduction,Huaxing had not yet realized the great value of KV100 then.One day,in a large foreign company’s branch in China,more than 20 computers were unexpectedly hit by a virus.The hard disks of the computers could not be booted as a result.The employees seemed stuck in limbo,as contracts valued over one hundred million dollars could not be printed out for the parties to sign.They were desperate for someone who could remove the virus.However,even the most pioneering anti-virus software developed by foreign countries had failed to meet the challenge.Without other means available,the company had to convene a meeting of computer service companies to seek help,and promised that in the future it would buy products from whoever could help solve the problem.Huaxing was one of the company’s hardware suppliers.Hearing the news,Huaxing made a longdistance call to Wang,and also hired an American anti-virus expert for 20,000 US dollars.When Wang came to the company in Beijing,he was just scoping the scene,while the American expert was investigating the virus.

As more of a “back-up expert,”Wang waited in the lounge for more than an hour.He was so bored that he went to the toilet several times.Seeing his physical inconvenience,a serviceman came forward to help him.However,Wang refused politely.He never wanted help.

In the end,the handsome American expert was not handsome at all,but kept snarling inside the room:“No! No!Format! Format!” He yelled with frustration and finally stormed out angrily.

It was Wang’s turn.He quickly identified that the machine had contracted the Torch virus.This virus only erased the disk partition table (DPT) and didn’t destroy data.In just 10 minutes,he successfully rebooted the virus-contracted machine.In over 20 minutes,he instructed the company’s employees how to remove the virus from all of the 20+ infected machines.Huaxing asked for 20 sets of KV100 from Wang and started selling them on the spot.

進(jìn)軍中關(guān)村

王江民第一次通過(guò)朋友介紹和華星公司接觸時(shí)，華星公司還沒(méi)特別意識(shí)到KV100 的巨大價(jià)值。有一天，一家國(guó)外大公司在華分公司的20 多臺(tái)電腦突染病毒，硬盤(pán)啟動(dòng)不了。公司員工都傻了，幾億元的合同打印不出來(lái)，急得要命，四處找人殺毒救急，結(jié)果國(guó)外最先鋒的反病毒軟件都沒(méi)有解決問(wèn)題。沒(méi)法子，該公司召集提供外圍技術(shù)支持的計(jì)算機(jī)公司開(kāi)了一個(gè)會(huì)，承諾誰(shuí)幫助解決了這次問(wèn)題，以后的硬件就從誰(shuí)那兒買(mǎi)。作為該公司硬件供應(yīng)商之一的華星公司將長(zhǎng)途電話打到王江民這里，還請(qǐng)了一個(gè)美國(guó)反病毒專(zhuān)家，開(kāi)價(jià)兩萬(wàn)美元。王江民來(lái)到北京這家外圍大公司時(shí)，正碰上美國(guó)專(zhuān)家在查解病毒。

作為“備胎”，王江民在休息廳等了一個(gè)多小時(shí)，幾次上廁所。見(jiàn)他身體不便，服務(wù)人員要上前扶助，王江民當(dāng)然拒絕，他從不要人攙扶。

帥氣的美國(guó)專(zhuān)家此時(shí)一點(diǎn)也不帥氣，在里面一個(gè)勁兒地咆哮：“No！No！Format（格式化）！Format！”最后氣急敗壞地出來(lái)。

輪到王江民了，他很快判定機(jī)器感染的是火炬病毒，這個(gè)病毒只抹去硬盤(pán)分區(qū)表，不破壞數(shù)據(jù)。10分鐘，王江民就讓病毒已經(jīng)發(fā)作的機(jī)器重新啟動(dòng)起來(lái)；20 多分鐘，王江民指導(dǎo)該公司的人把20 多臺(tái)機(jī)器上的病毒全部清除干凈。華星公司當(dāng)場(chǎng)留下了20 套KV100，并開(kāi)始接受轉(zhuǎn)讓?zhuān)N(xiāo)售KV100。

為了避免市場(chǎng)混亂，王江民在銷(xiāo)售KV200 時(shí)，決定由自己統(tǒng)一發(fā)放激光防偽，統(tǒng)一市場(chǎng)，統(tǒng)一價(jià)格。為了捍衛(wèi)自己的權(quán)益，他用升級(jí)的辦法爭(zhēng)取主動(dòng)：等硬盤(pán)分區(qū)表修復(fù)技術(shù)成熟后，把KV200 升級(jí)到KV300。也就是升級(jí)為KV300 這一年，王江民乘著那時(shí)風(fēng)行北京的一輛黃色“面的”進(jìn)軍中關(guān)村，以50萬(wàn)元的資金注冊(cè)了自己的公司——江民公司。

不同于別人，王江民有備而來(lái)，資金雖然不多，但憑成熟技術(shù)吃飯，足以創(chuàng)業(yè)。到中關(guān)村沒(méi)幾天，王江民就注意到中關(guān)村的商家喜歡“拼貨”，就是多家經(jīng)銷(xiāo)商聯(lián)起手來(lái)加大進(jìn)貨數(shù)額，求一個(gè)好的批發(fā)價(jià)格。他及時(shí)跟進(jìn)，將批發(fā)價(jià)定得很誘人，兩個(gè)“拼貨”的大單子下來(lái)，就掙了100 萬(wàn)元。中關(guān)村的舞臺(tái)太大了，僅一周他便旗開(kāi)得勝。

應(yīng)對(duì)各種挑戰(zhàn)

隨著互聯(lián)網(wǎng)技術(shù)的日漸成熟，病毒本身已不是問(wèn)題，問(wèn)題在于病毒延伸出來(lái)的挑戰(zhàn)。王江民反病毒，中國(guó)那些寫(xiě)病毒的人、制造病毒的人也在想方設(shè)法對(duì)付王江民。著名的“合肥1 號(hào)”病毒作者向王江民下了戰(zhàn)書(shū)：他居然將KV300 解密，把“合肥1 號(hào)”嵌入KV300 之中，然后把帶有“合肥1 號(hào)”病毒的KV300 解密放到網(wǎng)絡(luò)論壇上傳播。病毒發(fā)作后，“合肥1 號(hào)”病毒的作者在網(wǎng)上大肆宣傳KV300 中藏有病毒。制病毒與反病毒的斗爭(zhēng)被推到了臺(tái)前。絕頂之上的華山論劍真實(shí)地出現(xiàn)在IT 江湖上。這是華山之約，王江民也如同溫瑞安筆下四大名捕之“無(wú)情”，雖殘疾，但風(fēng)馳電掣，武功詭異絕倫，一招便將“合肥1 號(hào)”制伏于IT 業(yè)的華山之巔。

王江民把“合肥1 號(hào)”病毒殺了之后，它的作者馬上在網(wǎng)上跳出來(lái)說(shuō)：為什么只有王江民能殺這個(gè)病毒，而別人殺不了？那是因?yàn)橥踅褡约壕幜诉@個(gè)病毒！這個(gè)病毒應(yīng)該叫KV300 病毒。他一邊叫嚷，一邊又炮制出“合肥2 號(hào)”病毒，這是最難解、最厲害的Joke 病毒，它有無(wú)數(shù)次變形，幾乎把加密學(xué)上的所有加密手段都用上了。王江民頭疼了三天，用破解密碼的方法才把它殺了。

緊接著又出現(xiàn)“上海1 號(hào)”病毒、“上海2 號(hào)”病毒、“上海3 號(hào)”病毒?！吧虾? 號(hào)”干脆把病毒發(fā)作信息寫(xiě)作王江民的漢語(yǔ)拼音字母“wangjiangmin”，以惡心王江民。王江民把這三個(gè)病毒歸納了一下，出了一組反“上海病毒”的廣譜代碼。這之后再?zèng)]有出現(xiàn)“上海4 號(hào)”病毒，因?yàn)檫@個(gè)病毒的作者所寫(xiě)的病毒格式，再怎么改，再怎么花樣翻新，也逃不出王江民那一串《葵花寶典》般的廣譜查毒代碼。

王江民狠，這點(diǎn)他毫不掩飾。

2010年4月4日上午10點(diǎn)左右，王江民突然辭世，年僅59 歲。有人說(shuō)，上帝的電腦中毒了，所以帶走了王江民……

（摘自《中關(guān)村筆記》北京十月文藝出版社）

In order to protect his intellectual property and fight against piracy,he decided to uniformly label KV200 with an anti-counterfeiting laser mark and sold the new software at the same price.In order to protect his rights and interest,he also used an updating method to compete actively:He upgraded the KV200 to the KV300 after the disk partition table (DPT) repair technology was refined.In that year of the upgrading,Wang took a yellow taxi to Zhongguancun where he registered his company,Jiangmin Company,with a capital of 500,000 yuan.

Unlike others,Wang came prepared.Although the capital was not much,he could run a successful business with his unique technologies and expertise.Within a few days of arriving in Zhongguancun,Wang noticed that lots of merchants in Zhongguancun favored “Groupon buying goods,” that is to say,many dealers liked to make joint purchases that would increase the purchase quantity by which they could seek a good wholesale price.Wang grasped the chance in time and set the wholesale price very attractively.After making two big deals,he earned 1 million yuan.The arena of Zhongguancun was so big that he achieved success very quickly—in just one week.

Facing Various Challenges

With the maturing of Internet technologies,combating viruses was no longer a big problem.The new problems came from the challenges that the old,viruscombating issue extended.While Wang engineered antivirus programs,some hackers in China were trying to exchange blows with him.The author of the famous Hefei No.1 virus issued a statement to challenge Wang:He actually decoded the KV300,embedded Hefei No.1 into the KV300,and then spread the recoded KV300 on Internet forums.After the outbreak of the virus,he deceivingly posted on the Internet that there was a virus hidden in KV300.The rivalry between virus production and virus fighting was pushed to the front and center.Like a hero in a martial arts competition,with just one move,Wang subdued the Hefei No.1.

After being conquered by Wang,the author of the Hefei No.1 virus immediately posted on the Internet,questioning viciously:“Why can’t the others get rid of this virus,but Wang Jiangmin can? It’s because Wang himself created this virus! This virus should actually be named the KV300 virus.” While he was waging a campaign against Wang,the hacker concocted the Hefei No.2 virus.It was a most difficult and most powerful Joke virus.It could be varied with countless forms and used almost all encryption methods.Wang had suffered a headache for three days as he tried to conquer it,and after that,he cracked the code.

Immediately afterward,the Shanghai No.1,Shanghai No.2,and Shanghai No.3 viruses came one by one.The Shanghai No.3 virus even showed Wang’s full name in Pinyin on the screen of infected computers.It obviously aimed to sneer and antagonize him.

Wang accepted the challenge.He summarized these three viruses and produced a set of broadspectrum codes that removed all of the Shanghai viruses.After that,no Shanghai No.4 virus ever appeared,because no matter how the viruses changed and no matter how they were transformed,they could not escape Wang’s broadspectrum virus codes,which was as invincible as the almightySunflower Bible,a legendary martial art book mentioned in Louis Cha’s novel,The Legendary Swordsman.

Wang Jiangmin was ruthless in tackling viruses,and he made no secret of that.

At around 10 am on April 4,2010,Wang passed away suddenly at the age of 59.Some people said that it might be the computer of God contracted a virus,so he was summoned to help Him...

(FromZhongguancun Notes,Beijing October Literature and Art Publishing House.Translation:Xiao Jiayan)