Malware Signatures

  2. Home
  4. Malware Signatures
  6. html.defaced.nazihacker.001

html.defaced.nazihacker.001

Site got defaced by NaziHacker group. As a proof of a hack they usually leave files like x.htm, n-h.htm, n-h.txt. Their messages contain mix of Arabic and English. On some pages, there is markup for Arabian (Saudi Arabia) language (ar-sa).

Affecting

Any web site (no specific target).

Cleanup

Restore your site from a clean backup. Deleting all files first is the best option since it will delete all backdoors and other malicious files that
hackers could leave on the server. It is important to identify and close the security hole to prevent recurring attacks.
You can sign up with us and let our team remove the malware for you.

Dump

...excerpts from a typical defacement page...

<html dir="rtl">

<head>
<meta http-equiv="Content-Language" content="en-us">
<meta http-equiv="Content-Type" content="text/html; charset=windows-1256">
<title>&#1578;&#1605; &#1575;&#1604;&#1575;&#1582;&#1578;&#1585;&#1575;&#1602; &#1605;&#1606; &#1602;&#1576;&#1604; &#1606;&#1575;&#1586;&#1610; &#1607;&#1603;&#1585; </title>
<meta name="keywords" content="Hacked By Nazi Hacker , Hacked By Nazi H4x0R Hacked By Nazi Hacker , Hacked By Nazi H4x0R Hacked By Nazi Hacker , Hacked By Nazi H4x0R Hacked By Nazi Hacker , Hacked By Nazi H4x0R Hacked By Nazi Hacker , Hacked By Nazi H4x0R Hacked By Nazi Hacker , Hacked By Nazi H4x0R Hacked By Nazi Hacker , Hacked By Nazi H4x0R Hacked By Nazi Hacker , Hacked By Nazi H4x0R Hacked By Nazi Hacker , Hacked By Nazi H4x0R Hacked By Nazi Hacker , Hacked By Nazi H4x0R Hacked By Nazi Hacker , Hacked By Nazi H4x0R Hacked By Nazi Hacker , Hacked By Nazi H4x0R Hacked By Nazi Hacker , Hacked By Nazi H4x0R Hacked By Nazi Hacker , Hacked By Nazi H4x0R Hacked By Nazi Hacker , Hacked By Nazi H4x0R Hacked By Nazi Hacker , Hacked By Nazi H4x0R ">
<meta name="description" content="Hacked By Nazi Hacker , Hacked By Nazi H4x0R Hacked By Nazi Hacker , Hacked By Nazi H4x0R Hacked By Nazi Hacker , Hacked By Nazi H4x0R Hacked By Nazi Hacker , Hacked By Nazi H4x0R Hacked By Nazi Hacker , Hacked By Nazi H4x0R Hacked By Nazi Hacker , Hacked By Nazi H4x0R Hacked By Nazi Hacker , Hacked By Nazi H4x0R Hacked By Nazi Hacker , Hacked By Nazi H4x0R Hacked By Nazi Hacker , Hacked By Nazi H4x0R Hacked By Nazi Hacker , Hacked By Nazi H4x0R Hacked By Nazi Hacker , Hacked By Nazi H4x0R Hacked By Nazi Hacker , Hacked By Nazi H4x0R ">
</head>
...
<p align="center"><b><font face="Tahoma" color="#FFFFFF"><span lang="ar-sa">[ &#1578;&#1605;
&#1575;&#1604;&#1575;&#1582;&#1578;&#1585;&#1575;&#1602; &#1605;&#1606; &#1602;&#1576;&#1604; &#1606;&#1575;&#1586;&#1610; &#1607;&#1603;&#1585; </span></font><font face="Tahoma">
<a style="color: #FFFFFF;">]</a></font></b></p>
<p align="center"><b><font face="Tahoma" color="#FFFFFF">HaCked By Nazi HackEr</font></b></p>
<p align="center"><span lang="en-us">&nbsp;&nbsp;&nbsp; </span>
<img src="http://img11.imageshack.us/img11/3586/scarygraveyard1.jpg" border="0" height="269" width="357"></p>
<p align="center"><b><font face="Tahoma">

<a style="color: red;" href="">[</a>
<span class="short_text"><font color="#008080"><span lang="ar-sa">&#1575;&#1604;&#1571;&#1582;&#1578;&#1585;&#1575;&#1602; &#1571;&#1607;&#1583;&#1575;&#1569;
&#1604;&#1600; &#1606;&#1589;&#1601;&#1610; &#1575;&#1604;&#1579;&#1575;&#1606;&#1610; :</span>
...<span lang="ar-sa"> </span>Dmo3 aNsanH</font></span><font color="#008080">&gt;</font><span class="short_text"><font color="#008080"><span lang="en-us">
</span></font></span>
<a style="color: red;" href="">]</a></font></b></p>
<p align="center"><b><font color="#ff0000" face="Tahoma">. .</font></b></p>
<font face="Fixedsys"><b>

<p align="center"><font size="2" color="#ff0000" face="Tahoma">T</font><font size="2"><span lang="en-us"><font color="#ff0000" face="Tahoma">o
Contact :</font></span></font><font size="2" color="#ffffff" face="Tahoma">
Security80@Gmail.Com
</font></p>
<p align="center"><font size="2" color="#ff0000" face="Tahoma">. .</font></p>
</b></font><b>
...