Intercepting web traffic locally

Question

I am currently the victim of some kind of virus. I noticed this when I visited the Barclays site and was presented with some unusual questions about my details that just didn't seem right.

After some inspection, I found that after the closing </html> tag, there was some extra css & javascript includes that was capturing this information then posting it back to the current page via an iframe. Which I presume is being intercepted by the same program that's inserting this text.

My question is, how can I track down the program/utility/something that is injecting code into the webpage. (This is an attempt to try and find out where the information their capturing is being sent).

NOTE:

• It is not browser specific, the same code shows on all browsers (Firefox, IE, Opera).

Answer 1

Well, You can intercept and view traffic between your PC and any remote IP using Wireshark.

For the problem of browser hijacking, the malware must have a running process that is injecting the codes, scan your PC for malwares. Use something like MalwareBytes. To scan, first boot to safe mode, then run the program.

You can also use HijackThis to inspect the running processes. and then analyze them at their site. See if that helps. Run HijackThis in normal mode. not safe mode.

Answer 2

Since you have no idea what malware is on your pc it's safest to format your drive and reinstall Windows.