Member Avatar for Catweazle

A new virus has been found and it is targetting all you porn purveyors out there! The trojan named Yusufali-A seeks to help, not harm people by interrupting their depraved activity.

On an infected system, window titles are scanned for keywords such as:

sex
teen
xx
Phallus
jegger
Priapus
Phallic
Penis
Exhibitionism

and others. When a 'trigger' word is detected in the window title, Yusufali-A minimises the window, and display the following message in various languages:

"YUSUFALI: Know, therefore, that there is no god but Allah, and ask forgiveness for thy fault, and for the men and women who believe: for Allah knows how ye move about and how ye dwell in your homes. "

If the 'offending' window is left open, Yusufali-A will pop up a further message, with the mouse pointer 'trapped' within the message windows and with 3 buttons displayed - 'Logoff', 'Shutdown' and 'Restart'. All 3 buttons actually log you out. Keyboard control still exists whilst the pop up is active.

Removal is rather simple. See the instructions provided by Sophos. The virus is not malicious and is listed as a 'low' security risk.

Matter of fact it's one of the funniest viruses I've seen yet! STOP LOOKING AT PORN, OKAY!!

  • 3 Contributors
  • 2 Replies
  • 313 Views
  • 20 Hours Discussion Span
  • Latest Post Latest Post by Toulinwoek

Dani AI

Generated

nailed the flavour of this one — Yusufali‑A (aka Cager.A in some vendor writeups) is an unusual 2005 trojan that grabbed headlines because it interrupts certain browsing activity and shows a religious admonition rather than trying to steal data. Coverage at the time emphasised that it was more nuisance than destructive, and that infections required a user to run the program (social engineering via an attachment), so it was low‑risk technically but highly intrusive. (wired.com)

Practical cleanup and prevention (concise, step‑by‑step):

  1. Isolate the PC (unplug network / disable Wi‑Fi).
  2. Update your AV definitions and run a full system scan; use Windows Defender Offline or an on‑demand scanner if the running OS can’t clean the infection.
  3. If the malware resists in‑OS removal, boot a trusted rescue environment (bootable rescue disks / live AV tools) and scan from there.
  4. Inspect autorun/startup locations and remove any malicious entries (Sysinternals Autoruns is the go‑to tool for this). If unsure, document suspicious entries, export the registry keys for backup, then disable them. (support.microsoft.com)

Quick, actionable technical checks (examples to verify during cleanup):

Check Run keys:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
Check Startup folders:
%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup
%PROGRAMDATA%\Microsoft\Windows\Start Menu\Programs\Startup

If removal fails or the system shows persistent odd behaviour, back up essential user files (scan those backups on a clean machine), then perform a clean OS reinstall — that’s the only guaranteed way to restore trust. (softpedia.com)

A final note on intent and legality: folk like and are right to find the coder’s motivation striking, but whether “moral” or prankish, installing software on others’ machines without consent is unauthorized and can carry criminal penalties. Follow standard prevention advice (avoid unknown attachments, keep software updated, use least‑privilege accounts) and use multi‑engine checks (VirusTotal/private scans) when you need a second opinion on suspicious files. (justice.gov)

Recommended Answers

All 2 Replies

Member Avatar for Danny

Now THAT is a story of some highly motivated coders...

Member Avatar for Toulinwoek

Hmmmm...
First, socially engineered viruses, now socially conscious viruses. What's next, a virus that can detect you sitting at your computer munching on SusieQ's that then encourages you to go on a diet?
Or how about one that can detect pomposity that tells you you ain't as important as you think you are?
Or how about one that detects too many typing errors and automatically installs the latest version of Mavis Beacon, that you can't exit until you complete at least three lessons?

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.