Koran-Quoting Trojan

[Patient (imported)]

Bowdler & Comstock ride again!

Koran-Quoting Trojan Blocks Access To Porn Sites (http://www.informationweek.com/story/sh ... =170700839)

The text of the linked page:

Koran-Quoting Trojan Blocks Access To Porn Sites Sept. 6, 2005

The infection waits for the user to access a porn site, and then displays a quote from the Koran chastising the surfer.

By Gregg Keizer

TechWeb News

A new Trojan monitors access to porn sites and then displays a quote from the Koran chastising the surfer for his or her sins, a security vendor said Tuesday.

Once it's installed, Yusufali.a -- called "Cager.a" by Trend Micro -- watches which sites Windows users visit by examining the browser's title bar. If the Trojan sees a word in its list -- such as "teen," "xx," "sex," or "penis" -- it minimizes the window and displays a quote from the Koran.

"Yusufali: Know, therefore, that there is no god but Allah, and ask forgiveness for they fault, and for the men and women who believe: for Allah knows how ye move about and how ye dwell in your homes."

"This Trojan isn't trying to steal money or confidential information, but acting as a moral guardian instead, blocking viewing of sites it determines are unsavory," said Graham Cluley, senior technology consultant for Sophos, in a statement. " "This may have been written as a joke, or as a serious attempt to clean-up the habits of Internet users."

Eventually the Koran quote is replaced by a "For Exit Click Here" button. Once the user moves the mouse, however, the box changes to show three buttons -- LogOff, ShutDown, and Restart -- all of which when clicked log off the current user. The mouse cannot be moved outside the buttons' box.

That box shows the text "OH! NO i'm in the Cage," hence the moniker Cager.a by anti-virus vendor Trend Micro.

Copyright © 2005 CMP Media LLC, All rights reserved.

I woke up this morning with the horrible thought, "Oh, Lord, I bet that thing I got off the CMP site is copyrighted." Sure enough, at the extreme bottom of the page, below all the ads and promos and other distractions, was a copyright notice which i have now inserted above. To anyone offended by my omission I apologize and plead "fair use."

.