Hacked website/forums

[Cobalt Greywalker]

Bob,
    I've been on your homepage and the forums, and Symantic/Norton is having to block the Bitcoin miner javascript.
Norton is showing PUA.JSCoinminer when accessing both the homepage and the forums.  The files are coinhive.min[1].js and worker-asmjs.min[1].js

I still get near 80% CPU usage even with Symantic/Noton blocking them, but fortunately when I close the tab(s) to your pages it stops.
I am about to clear my cache and reattempt accessing your pages...
..And it still happens.

I will be sending this post via email.

Yours Sincerely,
Cobalt

[robkelk]

Is this the same issue as what was reported at http://www.accessdenied-rms.net/forums/s...?tid=12739 ?

[Bob Schroeck]

It may not be a false alarm. A quick look with Chrome's developer tools does in fact show coinhive somehow being called by my top page. I suspect one of the off-site widgets is might be compromised, as I have almost no javascript in my site otherwise (just the random headlines on the DW pages).

As soon as I get home tonight I'll kill those links and reupload the home page, and see if that makes a difference.

[Dartz]

I posted in the other thread...

...not sure if it's helpful or not,m but it's what I found

[Bob Schroeck]

It was indeed very helpful.

[Cobalt Greywalker]

OK, I'm glad to say that currently I am no longer (as of this post, and with a couple of cache clean ups) getting alerts about coinminer in the main page and the forums.

(This message will also be placed in the forums thread)