Pop-up window on all server sites, how to remove it?

Question

Nginx

Good day to all!
The situation is as follows, there are several sites on one physical server, recently this has begun:
When you open the site, and when you click on any link, an authorization window for VK.com pops up.
Moreover, on all sites this problem is solved only by refreshing the page or by waiting 3-4 seconds.

Answer 1

1. Find the malicious code through the "source code view" in the browser
2. Determine where approximately it appeared in the source code (before html or after)
3. Find the code in the template/core/module and delete
... But the question of how it got there is more interesting hit :-) after all, having done this, you cannot be sure that tomorrow all this will not happen again

Answer 2

Dig into the code, check for malware. You also need to look at the database.