Trojan swaps porn sites for Koran text
A new Trojan horse displays a message from the Muslim holy book when a user visits what could be a pornographic Web site.
The Trojan horse, dubbed "Yusufali-A," scans the title bar of the active Web browser window, which typically contains the name of a Web site. The program jumps into action when it sees any one of nine terms, including sex, teen, xxx, penis and exhibitionism, Sophos said in a description of the Trojan on its Web site.
When it determines that a pornographic Web site is being shown, the Trojan minimizes that window and displays a message from the Koran instead, Sophos said. If the offending site is not closed, a button labeled "For Exit Click Here" will appear. Moving the mouse to that box will lock it in and the user is forced to log out of Windows, according to Sophos.
Because of the way it is programmed, the Yusufali Trojan may also block innocent Web sites such as medical, educational and sites targeted at teenagers, Sophos notes.
Porn and malicious code have been married before, but more often explicit images are used to trick people into downloading a Trojan horse. Earlier this year however, Sophos found the Baba-C worm, which traveled by e-mail posing as a tool to clean porn from PCs.
The Yusufali Trojan horse is not widespread, Sophos said. Regardless, the Abingdon, England-based antivirus company, advises users to keep their antivirus software up to date.