+- Drunkard's Walk Forums (http://www.accessdenied-rms.net/forums)
+-- Forum: General (http://www.accessdenied-rms.net/forums/forumdisplay.php?fid=1)
+--- Forum: Website (http://www.accessdenied-rms.net/forums/forumdisplay.php?fid=4)
+--- Thread: Hacked website/forums (/showthread.php?tid=12742)
Hacked website/forums - Cobalt Greywalker - 01-25-2018
Bob,
I've been on your homepage and the forums, and Symantic/Norton is having to block the Bitcoin miner javascript.
Norton is showing PUA.JSCoinminer when accessing both the homepage and the forums. The files are coinhive.min[1].js and worker-asmjs.min[1].js
I still get near 80% CPU usage even with Symantic/Noton blocking them, but fortunately when I close the tab(s) to your pages it stops.
I am about to clear my cache and reattempt accessing your pages...
..And it still happens.
I will be sending this post via email.
Yours Sincerely,
Cobalt
RE: Hacked website/forums - robkelk - 01-25-2018
Is this the same issue as what was reported at http://www.accessdenied-rms.net/forums/showthread.php?tid=12739 ?
RE: Hacked website/forums - Bob Schroeck - 01-25-2018
It may not be a false alarm. A quick look with Chrome's developer tools does in fact show coinhive somehow being called by my top page. I suspect one of the off-site widgets is might be compromised, as I have almost no javascript in my site otherwise (just the random headlines on the DW pages).
As soon as I get home tonight I'll kill those links and reupload the home page, and see if that makes a difference.
RE: Hacked website/forums - Dartz - 01-25-2018
I posted in the other thread...
...not sure if it's helpful or not,m but it's what I found
RE: Hacked website/forums - Bob Schroeck - 01-25-2018
It was indeed very helpful.
RE: Hacked website/forums - Cobalt Greywalker - 01-26-2018
OK, I'm glad to say that currently I am no longer (as of this post, and with a couple of cache clean ups) getting alerts about coinminer in the main page and the forums.
(This message will also be placed in the forums thread)