Trojan acts as morality monitor

Trojan acts as morality monitor
The newly discovered Cager.A Trojan (aka Yusufali.A) acts as a porn policing morality monitor, blocking access to content it deems objectionable. The Cager.A Trojan monitors the Internet Explorer title bar, looking for text strings containing any of the following words: 'Exhibitionism', 'jeggar', 'Penis', 'Phallic', 'Phallus', 'Priapus', 'sex', 'teen', and 'xx'.

If these strings appear in the title bar, the Trojan will minimize the Internet Explorer window, preventing viewing of the content, and display a dialog with different translations of a Qur'an verse, including the following English translation (from Yusuf Ali):

YUSUFALI: Know, therefore, that there is no god but Allah, and ask forgiveness for thy fault, and for the men and women who believe: for Allah knows how ye move about and how ye dwell in your homes.

Allama Abdullah Yusuf Ali (often spelled Yusufali) was an English interpreter of the Qur'an (1872-1953).

The Cager.A Trojan maintains control of the mouse, eventually forcing the user to choose from one of three options: LogOff, Shutdown, or Restart. (The keyboard, however, remains functional).

Cager.A is a very low risk threat (Trend Micro reports zero copies seen), but it is receiving widespread media attention due to the titillating nature of its actions. A media article in Vnunet prompted this response from a reader:

"this isnt a virus its a god send any thing that brings down porn sites off the net has to be good. dont destroy it leave it going round the internet please its revenge for the pop ups"

The Cager.A, aka Yusufali.A Trojan also blocks access to the Registry Editor. Fortunately, a bug in the Trojan code creates a bogus autostart entry in the Registry, thus if an infected user reboots the PC, the Trojan will not reactivate when Windows is restarted. Use updated antivirus software to detect and remove this Trojan.
Tuesday September 06, 2005 #

link
http://antivirus.about.com/

some trojans aren't that bad after all