Once it's installed, Yusufali.a -- called "Cager.a" by Trend Micro -- watches which sites Windows users visit by examining the browser's title bar. If the Trojan sees a word in its list -- such as "teen," "xx," "sex," or "penis" -- it minimizes the window and displays a quote from the Koran.
"Yusufali: Know, therefore, that there is no god but Allah, and ask forgiveness for they fault, and for the men and women who believe: for Allah knows how ye move about and how ye dwell in your homes."
"This Trojan isn't trying to steal money or confidential information, but acting as a moral guardian instead, blocking viewing of sites it determines are unsavory," said Graham Cluley, senior technology consultant for Sophos, in a statement. " "This may have been written as a joke, or as a serious attempt to clean-up the habits of Internet users."
Eventually the Koran quote is replaced by a "For Exit Click Here" button. Once the user moves the mouse, however, the box changes to show three buttons -- LogOff, ShutDown, and Restart -- all of which when clicked log off the current user. The mouse cannot be moved outside the buttons' box.
That box shows the text "OH! NO i'm in the Cage," hence the moniker Cager.a by anti-virus vendor Trend Micro.