Troj/Yusufali-A is a Trojan for the Windows platform.
Troj/Yusufali-A analyzes the title of the window in focus looking for various words. Some of the words Troj/Yusufali-A searches for are:
sex
teen
xx
Phallus
jegger
Priapus
Phallic
Penis
Exhibitionism
If Troj/Yusufali-A finds one of these words in the title bar it will minimise the current window and display the following message in English along with other messages in other languages:
YUSUFALI: Know, therefore, that there is no god but Allah, and ask forgiveness for thy fault, and for the men and women who believe: for Allah knows how ye move about and how ye dwell in your homes.
The message displayed by the Trojan horse.
Troj/Yusufali-A will continue to display messages if the offending window is left open, and after a while it displays a box in the middle of the screen containing the current time and a button 'For Exit Click Here'. As soon as the mouse is moved the box changes to have vertical bars and the text 'OH! NO i'm in the Cage'. The box contains LogOff, ShutDown and Restart buttons and the mouse pointer is locked within the confines of the box. All the buttons actually cause a logout. The keyboard is still useable.
Another message displayed by the Trojan horse.
Troj/Yusufali-A may display a small text box on screen which displays the title of the window currently in focus. If the Registry Editor is running it will be minimised every few seconds.
Troj/Yusufali-A adds the following registry entries:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
LoadService
Virus
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
RavTimeXP
Virus
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
System4224411
Virus
Troj/Yusufali-A makes no attempt to rename or copy itself to virus.exe so these registry entries are unlikely to have any real effect.
Troj/Yusufali-A is listed as 'Yahosin' under the Applications tab in Task Manager.