Drunkard's Walk Forums

Full Version: Hacked website/forums
You're currently viewing a stripped down version of our content. View the full version with proper formatting.
Bob,
    I've been on your homepage and the forums, and Symantic/Norton is having to block the Bitcoin miner javascript.
Norton is showing PUA.JSCoinminer when accessing both the homepage and the forums.  The files are coinhive.min[1].js and worker-asmjs.min[1].js

I still get near 80% CPU usage even with Symantic/Noton blocking them, but fortunately when I close the tab(s) to your pages it stops.
I am about to clear my cache and reattempt accessing your pages...
..And it still happens.

I will be sending this post via email.

Yours Sincerely,
Cobalt
Is this the same issue as what was reported at http://www.accessdenied-rms.net/forums/s...?tid=12739 ?
It may not be a false alarm. A quick look with Chrome's developer tools does in fact show coinhive somehow being called by my top page. I suspect one of the off-site widgets is might be compromised, as I have almost no javascript in my site otherwise (just the random headlines on the DW pages).

As soon as I get home tonight I'll kill those links and reupload the home page, and see if that makes a difference.
I posted in the other thread...

...not sure if it's helpful or not,m but it's what I found
It was indeed very helpful.
OK, I'm glad to say that currently I am no longer (as of this post, and with a couple of cache clean ups) getting alerts about coinminer in the main page and the forums.

(This message will also be placed in the forums thread)