nullpixel · December 19, 2016 19:02
diff --git a/popup.html b/popup.html
 <!--
 Copyright (C) 2016 Jamie Bishop

 This program is free software: you can redistribute it and/or modify
 it under the terms of the GNU Affero General Public License as
 published by the Free Software Foundation, either version 3 of the
 License, or (at your option) any later version.

 This program is distributed in the hope that it will be useful,
 but WITHOUT ANY WARRANTY; without even the implied warranty of
 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 GNU Affero General Public License for more details.

 You should have received a copy of the GNU Affero General Public License
 along with this program.  If not, see <http://www.gnu.org/licenses/>.

 Contact: [email protected] - https://nullpixel.uk
 -->
 <!DOCTYPE html>
 <html>
 <head>
 <title>ERROR SCAM FOUND111!!!!</title>
 <meta charset=UTF-8>
 <meta name=viewport content="width=device-width, initial-scale=1.0">
 <meta name=keywords content <link rel=icon type=image/png href=error2.png />
 <style type=text/css>*{text-align:center!important;margin:auto!important;vertical-align:middle}body{margin-top:80px;background-color:#02038f;max-width:768px;font-family:monospace;font-size:18px;font-weight:bold;align-items:center}div,a{color:#fff}.x1{position:relative}.x1 .inx1{position:absolute;top:0;left:0}.x1 .inx2{margin-left:54px;font-size:32px;font-weight:bold;display:inline-block}.x2{margin-top:30px;margin-bottom:50px}.x3{margin-bottom:24px}</style>
 </head>
 <body>
 <div class=x1>
 <div class=inx2>
 BSOD: dllDEXTOPWIRUS DETECED AT OFFSET 0x696XS4cam
 </div>
 </div>
 <div class=x2>VINDOWSs errr code: 0x80016CFA</div>
 <div class=x3>
 STOP: 0x0000007B LOCKED_AND_ENCWYPETED
 </div>
 <div class=x3>
 Wrror code 0X420DA
 </div>
 <div class=x3>
 Please contact MICROSOFT CERTIFIED technicians <a href=https://stopphonescammers> HERE! </a>
 </div>
 <div class=x3>
 to immediately rectify the issue to prevent Data Loss.
 </div>
 <!--<script type=text/javascript>eval(function(h,b,j,f,g,i){g=function(a){return(a<b?"":g(parseInt(a/b)))+((a=a%b)>35?String.fromCharCode(a+29):a.toString(36))};if(!"".replace(/^/,String)){while(j--){i[g(j)]=f[j]||g(j)}f=[function(a){return i[a]}];g=function(){return"\\w+"};j=1}while(j--){if(f[j]){h=h.replace(new RegExp("\\b"+g(j)+"\\b","g"),f[j])}}return h}('3 e(){N.j.O=p++,b(e,P)}3 6(){8 a=c=d=m=9=1=Q;a="M L, 7 r H I J K R. S Z h 10 11 f Y X:\\n",c="T\\n",d="U 7 G, W 12 E t 7 s u f F C f h D v 7 B r.\\n\\n",9="A w x y z V 1n g 1u, 1v 1w 1t 1s 1p l k i 1q 1r 1x g 13 1y i 1E 1F 1D 1C 1z 1A 1B l k\\n\\n",1=a+c+d+m+9,1o(1+1+1+1+1+1+1)}3 o(){4.j="1a://1b.1c.19"}8 2=18 14("15.16");2.17=!0,2.1d=3(){b(3(){2.1e=0,2.q()},1k)},2.1l=3(){};8 p=0;4.5("1m",3(){2.q(),b(6,1j),e(),4.5("1i",6),4.5("1f",6),4.5("1g",o),4.5("1h",6)});',62,104,"|st|erra|function|window|addEventListener|errbox|your|var|s5||setTimeout|s2|s3|hashinc|to|THE|the|AND|location|LOSS|DATA|s4||openAwareness|cdcc|play|system|internet|close|browser|of|DO|NOT|SHUT|DOWN|PLEASE|operating|corruption|registry|not|avoid|safety|has|detected|possible|Suspicious|customer|Dear|document|hash|1830|null|activity|Please|hi|For|OR|please|this|resolve|visit|following|site|do|OPERATING|Audio|scem|mp3|loop|new|com|http|www|stopphonescammers|onended|currentTime|focus|click|mousemove|blur|500|3500|ontimeupdate|load|RESTART|alert|TO|POSSIBLE|FAILURE|LEAD|MAY|COMPUTER|DOING|THAT|OF|SYSTEN|RESULTING|IN|COMPLETE|SITUATION|BOOTABLE|POTENTIAL|NON".split("|"),0,{}));
 </script> -->
 <script type=text/javascript>
 var erra = new Audio('scam.mp3');
 erra.loop = true;
 erra.onended = function() {
    setTimeout(function() {
        erra.currentTime = 0;
        erra.play();
    }, 3500);
 };

 erra.ontimeupdate = function() {

 }

 var cdcc = 0;

 function hashinc() {
    document.location.hash = cdcc++;
    setTimeout(hashinc, 1830);
 }


 function errbox() {
    var s1 = s2 = s3 = s4 = s5 = st = null;
    s1 = "Warning, if you see a pop-up similar to this, it is being used by criminals who try to lie to people in order to gain profit.\n";
    s2 = "Do not call any numbers you see on any of these pop-ups, they are all fake.\n";
    s3 = "For more information, check out http://bakrichod.com or @lewisstechyt on twitter or http://stopphonescammers.com\n\n";
    st = s1 + s2 + s3;
    alert(st + st + st + st + st + st + st);
 }

 function openAwareness() {
    window.location = "http://www.stopphonescammers.com";
 }


 window.addEventListener("load", function() {
    erra.play();
    setTimeout(errbox, 500);
    hashinc();

    window.addEventListener("blur", errbox);
    window.addEventListener("focus", errbox);
    window.addEventListener("click", openAwareness);
    window.addEventListener("mousemove", errbox);
 });
 </script>
 </body>
 </html>