Re: Something is injecting malware into my HTTP traffic

2015-03-22 Thread shimi
On Sun, Mar 22, 2015 at 11:10 AM, Roman Ovseitsev rom...@gmail.com wrote: Thanks everyone! That explains it then. It interesting how the cached version is actually slower to download than the non-cached. I haven't noticed the speed difference prior to Michael mentioning it, but now after

Re: Something is injecting malware into my HTTP traffic

2015-03-22 Thread Roman Ovseitsev
Thanks everyone! That explains it then. It interesting how the cached version is actually slower to download than the non-cached. I haven't noticed the speed difference prior to Michael mentioning it, but now after some random tests the behaviour seems to be consistent with other sites as well.

Re: Something is injecting malware into my HTTP traffic

2015-03-21 Thread Amos Shapira
Just speculating, but could it be that your ISP uses a caching transparent proxy (which would explain why it doesn't happen on SSL) and its cache got corrupted? The other ISP case could be explained if it's actually upstream/downstream from your ISP, or they share a proxy cache for other reasons.

Re: Something is injecting malware into my HTTP traffic

2015-03-21 Thread E.S. Rosenberg
Depending on the version of windows and it's network environment you freshly installed rootkits could be likely, but that is OT here. Note that different ISP in Israel is a fairly relative statement since there are basically just a few major players who own a bunch of the smaller ISPs and could

Re: Something is injecting malware into my HTTP traffic

2015-03-21 Thread Etzion Bar-Noy
Traceroute is useless. Only traffic directed at port 80 is routed through the proxies. Nothing else, meaning that ICMP, used for traceroute, would got to the target directly. There are methods of identifying transparent proxies (you could probably ask Google about them), however, this is not one

Re: Something is injecting malware into my HTTP traffic

2015-03-21 Thread Amos Shapira
So there might be your answer - I guess nv stands for netvision - give them the URL and ask them to clear the cache for it. On 22 March 2015 at 05:56, Michael Tewner tew...@gmail.com wrote: I'm seeing the same thing, that is, the downloaded files start to differ at byte #4101 - The HTTPS

Re: Something is injecting malware into my HTTP traffic

2015-03-21 Thread Michael Tewner
I'm seeing the same thing, that is, the downloaded files start to differ at byte #4101 - The HTTPS version downloaded quite fast on my 5Mbps connection. The HTTP one is taking forever, quite literally; it's stalled - I've tried adding Cache-Control: no-cache and Pragma: no-cache, but