AT&T Tech Support 360
September 6, 2005 5:25 PM PDT
Trojan swaps porn sites for Koran text
- Related Stories
-
Worm baits hook with hints of pope plot
June 28, 2005 -
Baba worm pretends to purge porn
January 20, 2005 -
Bawdy holiday worm preys on prurience
January 11, 2005
The Trojan horse, dubbed "Yusufali-A," scans the title bar of the active Web browser window, which typically contains the name of a Web site. The program jumps into action when it sees any one of nine terms, including sex, teen, xxx, penis and exhibitionism, Sophos said in a description of the Trojan on its Web site.
When it determines that a pornographic Web site is being shown, the Trojan minimizes that window and displays a message from the Koran instead, Sophos said. If the offending site is not closed, a button labeled "For Exit Click Here" will appear. Moving the mouse to that box will lock it in and the user is forced to log out of Windows, according to Sophos.
Because of the way it is programmed, the Yusufali Trojan may also block innocent Web sites such as medical, educational and sites targeted at teenagers, Sophos notes.
Porn and malicious code have been married before, but more often explicit images are used to trick people into downloading a Trojan horse. Earlier this year however, Sophos found the Baba-C worm, which traveled by e-mail posing as a tool to clean porn from PCs.
The Yusufali Trojan horse is not widespread, Sophos said. Regardless, the Abingdon, England-based antivirus company, advises users to keep their antivirus software up to date.
See more CNET content tagged:
Sophos Plc.,
trojan horse
- "Our lawyer"?
- Is this related to a virus using this phrase: "Our lawyer has informed us we need a warning..." I got hit with this a few days ago when I was either on myspace or msn.com. It opened up about 25 Explorer windows before I could stop it. I googled the phrase and I know it's out there, but what is it? I haven't heard much about it. Anyone know? Thanks.
- Reply to this comment
