Site got defaced by the DarkFlamez group. This group usually leaves the homepage of hacked sites intact while adding
the pawn3d.php page as a proof of the hack.
Affecting
Any web site (no specific target).
Cleanup
Restore your site from a clean backup. Deleting all files first is the best option since it will delete all backdoors and other malicious files that
hackers could leave on the server. It is important to identify and close the security hole to prevent recurring attacks.
You can sign up with us and let our team remove the malware for you.
Dump
...excerpts from a typical defacement page...
<meta name="keywords" content="Hacked by Darkz Flamez , pawned by darkz flamez"/>
<meta name="description" content="Hacked by Darkz Flamez"/>
<title>Hacked By Darkz Flamez</title>
...
<div class="LocalGhost" align="center">Darkz Flamez</div>
<div class="ISD" align="center">p4wn3d by Darkz Flamez </div>
<div class="email" align="center"><table width="698" border="0">
<tr>
<td width="692"><marquee class="thanks">Special Greetz : AWEK AKU | United of Muslims Cyber Army | Phantoms Crews Official | Dark Assassins Cyber Crew | Cyber IT Crew | Eagle Eye | BK200 | NoEntry Phc | Mr.AzRooT | Azri Aken</marquee></td>
</tr>
</table>
</div></td>
<div class="email" align="center">:::SYSTEM HACKED:::</div>
...
<EMBED SRC="http://divine-music.info/musicfiles/Eminem%20ft.%20Rihanna%20-%20Love%20The
%20Way%20You%20Lie.swf"
AUTOSTART="TRUE" LOOP="TRUE" WIDTH="1" HEIGHT="1" ALIGN="CENTER"></EMBED>
<script type="text/javascript">
...