Troj/Yusufali-A

Please follow the instructions for removing Trojans.

Windows NT/2000/XP/2003

In Windows NT/2000/XP/2003 you will also need to edit the following registry entry. The removal of this entry is optional in Windows 95/98/Me. Please read the warning about editing the registry.

At the taskbar, click Start|Run. Type 'Regedit' and press Return. The registry editor opens.

Before you edit the registry, you should make a backup. On the 'Registry' menu, click 'Export Registry File'. In the 'Export range' panel, click 'All', then save your registry as Backup.

Locate the HKEY_LOCAL_MACHINE entry:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\

and remove any reference to any file you deleted.

Close the registry editor.

Troj/Yusufali-A is a Trojan for the Windows platform.

Troj/Yusufali-A analyzes the title of the window in focus looking for various words. Some of the words Troj/Yusufali-A searches for are:

sex
teen
xx
Phallus
jegger
Priapus
Phallic
Penis
Exhibitionism

If Troj/Yusufali-A finds one of these words in the title bar it will minimise the current window and display the following message in English along with other messages in other languages:

YUSUFALI: Know, therefore, that there is no god but Allah, and ask forgiveness for thy fault, and for the men and women who believe: for Allah knows how ye move about and how ye dwell in your homes.

The message displayed by the Trojan horse.

Troj/Yusufali-A will continue to display messages if the offending window is left open, and after a while it displays a box in the middle of the screen containing the current time and a button 'For Exit Click Here'. As soon as the mouse is moved the box changes to have vertical bars and the text 'OH! NO i'm in the Cage'. The box contains LogOff, ShutDown and Restart buttons and the mouse pointer is locked within the confines of the box. All the buttons actually cause a logout. The keyboard is still useable.

Another message displayed by the Trojan horse.

Troj/Yusufali-A may display a small text box on screen which displays the title of the window currently in focus. If the Registry Editor is running it will be minimised every few seconds.

Troj/Yusufali-A adds the following registry entries:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
LoadService
Virus

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
RavTimeXP
Virus

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
System4224411
Virus

Troj/Yusufali-A makes no attempt to rename or copy itself to virus.exe so these registry entries are unlikely to have any real effect.

Troj/Yusufali-A is listed as 'Yahosin' under the Applications tab in Task Manager.