I was looking through a static site I created on my local server, in my web browser, and found a curious call to an external script
Placed just before the closing of
</head> which leads to this code
My attention was drawn to it by the unescaped ampersands, and I had no memory of putting it there. Checking the source code I found no existence of this script.
More alarming, looking at the sources of my sites resources show a sleuth of material I have no knowledge of. This is particularly perplexing on a static site which, is not live, and has no plugins or external media! At the very least it is putting a significant drag on loading the site (particularly due to a lack of response from a "linkr.us" server), but more to the point I am concerned about security vulnerabilities on my other sites.
How do I go about tracing the origin of what I can only assume is malicious code?