Sorry the site is NOT coinwave, but coinhive
Apologies.
John W
I not 100% sure of what Coinhive is but from my very quick research, it sounds like a mining script.
From what you’ve written, I don’t believe you have malicious code on your website, just a link to coinhive
I would search your entire website for the link to Coinhive and delete it
Can you provide a link to your website
I am having difficulty searching the site, can you advise best way please?
if the site has malware then spreading the site link around via this post is not something i really want to do at this stage.
thx
John W
I understand your concern about adding a link. I’m fully protected when it comes to this. Just make use to leave a space between your url and the tlds.
You can use plugins to see if it’s in the database, such as ‘Better Search Replace’
They are plugins to scan your website for malicious code too. You can also contact your web hosting to see which page the malicious code is coming from
The link is glandore(nospace)village .ie
I have tried plugin to locate any code that maybe linked to this event and Nothing…..]
Am waiting back from Hosting Company to find out a little more from them.
thx
John W
Try using some of these. – https://geekflare.com/online-scan-website-security-vulnerabilities/#1-Scan-My-Server
I’ve used Sucuri and all is says is your firewall isn’t the strongest. I’m going to look now for you
Gareth
I’ve viewed your source code and it’s located in the <head> being loaded as a script. Search on google how to view the source code in your preferred browser.
It’s either hardcoded into your theme head.php, being added through your function.php in your theme or a plugin is adding the script.
It should be easy to find, but you’ll have to look through your files. If you have a local version of your website, it should be easy to find through a search folder function in your code editor.
Good Luck,
Gareth
Gareth,
Firstly, Thanks You for taking an interest in my issue, and doing all that work.
The issue was caused by a plugin for a Weather widget called Weather for us. Which i had on every page.
Based on your response, i remembered that one fo the tools i had used in the past was GTmetrix, to analyse the sites performance, but one of the things it does is list all the accesses both ways to and from the web server hosting the wordpress site. I found the associated request for the malicious URL within the GTmetrix “waterfall” page were it clearly showed the request and how long the process was taking, also slowing down he site… and as the weather widget was on every page it was not difficult to prove that this was in fact the cause of the Malicious code.
Once i removed the Widget from the pages the request to the URL stopped. I will check with my Hosting company, but i am confident it is sorted. thanks for your help.
John W
Hello,
Further to my last response if you want to read some pretty negative press about this developer read the following:-
https://ww.wp.xz.cn/plugins/weather-for-us-widget/#reviews
When i downloaded this plugin these comments were not available….
Anyway. progress one more bad guy identified.
John W
Hi @ejwjohn, I am glad to hear that you have finally found the issue.
It can be challenging to find out if a developer is honest or not when it comes to coding. However I have a rule that I always follow when I test a new plugin. And of course I always use my testing sites locally to test new plugins and themes.
1. Functionality as per description.
2. Support provided in the forum.
3. The number of downloads.
4. The number of positive reviews.
5. Is the plugin up to date with the latest WordPress version.
However even with the above list, you can still install a plugin that has malware or other malicious code added. But the good news is that WordPRess team are very fast at responding and blocking or closing down any plugin or theme that adds malicious code.
I just thought of replying just to let you know that I was monitoring this thread.
Enjoy the plugin.
Kind regards
Thank You.
I continue to learn…… i am still relatively new to the WordPress environment, and it is good to know that the support is there and people are generous with their time.
However, from my perspective, i need to reassess how i deploy and test sites, with proven reliable plugins.
Thanks
John W
I’m having the same issue, coinhive showing up in gtmetrix waterfall.
However SUCURI isn’t showing anything for my page as malicious, and I’ve inspected the sourcecode but don’t see it being loaded from there
warning: mature themes (no nudity though)
http://dailysupreme . com/s/E70/MSK-A2ist02-A18e4to4ia5/LTesting.php
Hello,
In my case there was no malicious code embedded into the site, the code is loaded as a result of an embedded link generated from within the weather widget. Which then loads the Coinhive code into the pc/mac of the user, which proceeds to “steal” spare hardware processor capacity to perform its deeds….. end effect your pc/mac slows down without you knowing….
Well this is what i believe….
John W
