“Unlike other malware, it appears this Trojan horse isn’t trying to steal money or confidential information, but acting as a moral guardian instead—blocking viewing of websites it determines are unsavory,” Senior Technology Consultant Graham Cluley said.
The program, called Yusufali-A, monitors words in the title bars of active windows, apparently searching for sexual terms such as “teen,” “xxx” and “hardcore,” then minimizes the window and launches a box containing a passage from the Koran.
Instead of being able to see adult content, a user gets the following message in both Arabic and English: “Know, therefore, that there is no god but Allah, and ask forgiveness for thy fault, and for the men and women who believe: for Allah knows how ye move about and how ye dwell in your homes.”
If a user doesn’t close the offending window within a few seconds, the program displays a button that reads, “For Exit, Click Here.”
After that, any mouse movement results in the worm delivering a second message containing the headline, “Oh, no, I’m in the cage,” along with three buttons marked, “Log Off,” “Shut Down” and “Restart.” The box traps users’ cursors, leaving them no option but to click one of the buttons. When they do, they are logged off their computers.
Cluley said the worm is prone to mistakes and has been found to block medical and academic sites as well as sites intended for teenage audiences.