Malware Signatures

  2. Home
  4. Malware Signatures
  6. html.defaced.horrorscary.001

html.defaced.horrorscary.001

This is a defacement attack conducted by Horror404 of the NusantaraCyber Army. Titles of defaced pages typically say "./HorrorScary Was Here"

Affecting

Any web site (no specific target).

Cleanup

Restore your site from a clean backup. Deleting all files first is the best option since it will delete all backdoors and other malicious files that
hackers could leave on the server. It is important to identify and close the security hole to prevent recurring attacks.
You can sign up with us and let our team remove the malware for you.

Dump

...excerpts from a typical defacement page...

<script src='http://nirav07.110mb.com/jsnow.js' type='text/javascript'/>
<script type='text/javascript'>
$(function() {
$().jSnow();
});
</script>

<title>./HorrorScary Was Here</title>
<link href='http://julvikarfarhan.info/images/nucy.png' rel='shortcut icon'/>
...
<center><p><font face="MV Boli" size="10" color="white">Single Attacker <font

color="#x21d0x21">Horror404</font></font></p></center>
<center><p><font face="MV Boli" size="5" color="#666666">SHOW ME YOUR SKILL =D

THANKS FOR , TALK LESS DO MORE , YOUR MOUTH IS BIG COK </font></p></center>
<center><p><font face="MV Boli" size="10" color="#XXXXXX">Nusantara Cyber

Army</font></p></center>