Arabic Trojan butts into porn surfing

Yusufali-A Trojan monitors users' surfing habits

Security experts today issued a warning after detecting a malicious Trojan horse which tries to interrupt the surfing of adult websites by displaying messages from the Koran.

The Yusufali-A Trojan monitors users' surfing habits by examining the title bar of the active window.

If the Trojan finds a key word such as 'teen', 'xx', 'sex' or 'penis', it minimises the window so that the user cannot see its content and displays a message from the Koran instead.

The message, which is partly written in Arabic, contains the following English text: "Yusufali: Know, therefore, that there is no god but Allah, and ask forgiveness for they fault, and for the men and women who believe: for Allah knows how ye move about and how ye dwell in your homes."

Graham Cluley, senior technology consultant at Sophos, said: "Unlike other malware, it appears that this Trojan isn't trying to steal money or confidential information, but acts as a moral guardian instead, blocking the viewing of websites it determines as unsavoury.

"Of course, it's possible for the Trojan to make mistakes and block sites that are not pornographic, such as medical sites or social sites designed for teenagers."

Yusufali-A continues to display messages if the offending website remains open, and after a while displays a button labelled 'For Exit Click Here'.

As soon as the mouse is moved the box changes to show vertical bars and the text 'OH! NO i'm in the Cage'.

The box contains LogOff, ShutDown and Restart buttons and the mouse pointer is locked within the confines of the box. All the buttons actually cause the computer to logout.

"This Trojan may have been written as a joke, or as a serious attempt to clean up the habits of internet users," said Cluley.

"Whatever the reasons behind its creation, computer users should protect their systems with up-to-date antivirus software, security patches and a proper firewall."