"MELLPON" virus which preserves child pornographic image arbitrarily and virus "Noped" reporting simple possession of child pornography

On the ban on simple possession of child pornography, on the 22nd of this month, the LDP and Komeito will "Penalty for penal servitude or fine if there is a breachIt is decided to hurry the bill making work in the direction of "Democratic Party"Collected or acquired for pleasureAlthough it seems to be limited to, there are viruses that already preserve child pornographic images without permission and viruses that detect simple child possessions of child pornography and report to related organizations.

Details of the activity of this virus are as follows.
■ Virus "MELLPON" to preserve child pornographic images without permission (Mel Pong)


TROJ_MELLPON.A - Detail

This virus is a so-called Trojan horse type, original of what was originally called "Yamada virus" in 2005. Although the virus that improved this virus has occurred like a mountain, the original "TROJ_MELLPON.A" shows the following behavior when infected.

When executed, the malware creates a folder with the same name as itself. This folder contains illegal pornographic images, and the size is about 4.46 MB.

The following article reports that this "illegal pornographic image" is a child porn image.

Trend Micro corresponds to "Yamada virus" to write on 2 chan

When infected with MELLPON.A, a folder "mellpon" is created in the PC. About 4.46 MB of child pornographic images are stored in the mellpon folder.

Of course, the type of this child pornographic image can be changed to various things if the virus writer is a little devised, and in the case where the simple possession is illegalized probably the number of possession of the image etc. probably has sexual interests "Since it is asked whether it was preserved or not, it may become a rather delicate line.

By the way, overseasJust tried and arrested just because "evidence of preservation remained" has been convictedTherefore, I do not know how far we can apply argument that "Because it is only infected with virus, it does not become a simple possession".

■ Virus that reports simple child possession of child "Noped" (noped)


Japan F-Secure Co., Ltd.: Virus information Noped.A

VBS.Noped.A@mm - Symantec.com

This virus is a worm type written in the VB script, and it seems to notify government agencies a list of JPEG files matching the file name of a certain condition. The problem is that its "certain condition", strictly speaking, it detects whether it is a file name often used for child pornography.

A worm that searches for child pornography and reports it, it appears (SARC)

The subject of the e - mail in which the Noped worm is embedded is "FWD: please cooperate in eradicating illegal child pornography", and in the text thereof, it is stated that "please read the attached document immediately".

Worm to find and report child pornography "Nope" | WIRED VISION

In the warning mail, one copy of the suspected child pornography file found by the worm searching for the infected hard disk is attached. It also notifies the e-mail address of the child pornographic owner.

The text file displayed on the notepad contains information on the legal definition of child pornography and warned that any sexually explicit photograph of a child under the age of 17 is child pornography . And if you own or send such images to the user of the machine infected with the worm, it tells what punishment is waiting.

If it seems that the behavior of this virus is correct it is quite dangerous. For if "a purpose justifies a means", it is a story that it can do whatever it is, so that it can be expanded and interpreted any number of times. For that reason, if you spread viruses and spread them, the default is overwhelming. Moreover, even if saying that child pornographic image is detected, it is possible to obtain false alarm simply because it is simply examining by file name. Perhaps in the future we will not be able to deny the possibility that a variant of discovering child pornographic images with more sophisticated algorithms will emerge in order to be more accurate ... ....

It would be innocent if we could prove that the simple possession of child pornographic images is the work of these malicious viruses, but how can we prove it ...... If you do not take care more security than yourself, your life The possibility of collapse in an instant is great.