Trojan swaps porn sites for Koran text
Posted: Wed Sep 07, 2005 12:05 pm
Source: ZDNet Au. Date: Wed Sep 07, 2005
A new Trojan horse is serving as a moral guard of sorts, displaying text from the Koran if users visit what could be a pornographic Web site, Sophos warned on Monday.
The Trojan horse, dubbed "Yusufali-A," scans the title bar of the active Web browser window, which typically contains the name of a Web site. The program jumps into action when it sees any one of nine terms, including sex, teen, xxx, penis and exhibitionism, Sophos said in a description of the Trojan on its Web site.
When it determines that a pornographic Web site is being shown, the Trojan minimises that window and displays a message from the Koran instead, Sophos said. If the offending site is not closed, a button labelled "For Exit Click Here" will appear. Moving the mouse to that box will lock it in and the user is forced to log out of Windows, according to Sophos.
Because of the way it is programmed, the Yusufali Trojan may also block innocent Web sites such as medical, educational and sites targeted at teenagers, Sophos notes.
Porn and malicious code have been married before, but more often explicit images are used to trick people into downloading a Trojan horse. Earlier this year however, Sophos found the Baba-C worm, which travelled by e-mail posing as a tool to clean porn from PCs.
The Yusufali Trojan horse is not widespread, Sophos said. Regardless, the Abingdon, England-based antivirus company, advises users to keep their antivirus software up to date.
A new Trojan horse is serving as a moral guard of sorts, displaying text from the Koran if users visit what could be a pornographic Web site, Sophos warned on Monday.
The Trojan horse, dubbed "Yusufali-A," scans the title bar of the active Web browser window, which typically contains the name of a Web site. The program jumps into action when it sees any one of nine terms, including sex, teen, xxx, penis and exhibitionism, Sophos said in a description of the Trojan on its Web site.
When it determines that a pornographic Web site is being shown, the Trojan minimises that window and displays a message from the Koran instead, Sophos said. If the offending site is not closed, a button labelled "For Exit Click Here" will appear. Moving the mouse to that box will lock it in and the user is forced to log out of Windows, according to Sophos.
Because of the way it is programmed, the Yusufali Trojan may also block innocent Web sites such as medical, educational and sites targeted at teenagers, Sophos notes.
Porn and malicious code have been married before, but more often explicit images are used to trick people into downloading a Trojan horse. Earlier this year however, Sophos found the Baba-C worm, which travelled by e-mail posing as a tool to clean porn from PCs.
The Yusufali Trojan horse is not widespread, Sophos said. Regardless, the Abingdon, England-based antivirus company, advises users to keep their antivirus software up to date.
ka xishoot gabdhaha
