Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am currently the victim of some kind of virus. I noticed this when I visited the Barclays site and was presented with some unusual questions about my details that just didn't seem right.

After some inspection, I found that after the closing </html> tag, there was some extra css & javascript includes that was capturing this information then posting it back to the current page via an iframe. Which I presume is being intercepted by the same program that's inserting this text.

My question is, how can I track down the program/utility/something that is injecting code into the webpage. (This is an attempt to try and find out where the information their capturing is being sent).


  • It is not browser specific, the same code shows on all browsers (Firefox, IE, Opera).
share|improve this question
What is your OS? – soandos Jan 29 '12 at 6:35

Well, You can intercept and view traffic between your PC and any remote IP using Wireshark.

For the problem of browser hijacking, the malware must have a running process that is injecting the codes, scan your PC for malwares. Use something like MalwareBytes. To scan, first boot to safe mode, then run the program.

You can also use HijackThis to inspect the running processes. and then analyze them at their site. See if that helps. Run HijackThis in normal mode. not safe mode.

share|improve this answer
I think, it is better if you do it in safe mode. – Sachin Divekar Jan 29 '12 at 6:16
Scanning for malware, yes, better to do in safe mode. But if he chooses to use HijackThis, then its better not to do it in safe mode. Wait, I'll specify it in answer. – Bibhas Jan 29 '12 at 6:42

Since you have no idea what malware is on your pc it's safest to format your drive and reinstall Windows.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .