Religious trojan nabs naughty surfers

The Yusufali.A virus monitors the title bar of an active window and looks for words such as "XXX", "Sex" and "teen", if it finds anything offensive it minimizes the window and displays a religious message.

"Unlike other malware, it appears this Trojan horse isn't trying to steal money or confidential information, but acting as a moral guardian instead - blocking viewing of websites it determines are unsavory," said Graham Cluley, senior technology consultant at antivirus company Sophos. "Of course, it's possible for the trojan to make mistakes and block sites which are not pornographic - such as medical sites, or social sites designed for teenagers."

The trojan will continue to display the message for as long as the window remains open. After a period of time it displays a button saying "For exit click here", but users trying to escape will merely be greeted by another message taunting them. The mouse pointer is then locked inside a box from which the user can only exit by logging out.

Earlier this month SC reported viruses have taken a dip in the past couple of months with less circulating than at the beginning of the year. Phishing too is down, falling by half over the last month alone.

www.sophos.com