Re: Something is injecting malware into my HTTP traffic

2015-03-21 Thread Amos Shapira
Just speculating, but could it be that your ISP uses a caching transparent proxy (which would explain why it doesn't happen on SSL) and its cache got corrupted? The other ISP case could be explained if it's actually upstream/downstream from your ISP, or they share a proxy cache for other reasons.

Re: Something is injecting malware into my HTTP traffic

2015-03-21 Thread E.S. Rosenberg
Depending on the version of windows and it's network environment you freshly installed rootkits could be likely, but that is OT here. Note that different ISP in Israel is a fairly relative statement since there are basically just a few major players who own a bunch of the smaller ISPs and could

Re: Something is injecting malware into my HTTP traffic

2015-03-21 Thread Etzion Bar-Noy
Traceroute is useless. Only traffic directed at port 80 is routed through the proxies. Nothing else, meaning that ICMP, used for traceroute, would got to the target directly. There are methods of identifying transparent proxies (you could probably ask Google about them), however, this is not one

Re: Something is injecting malware into my HTTP traffic

2015-03-21 Thread Amos Shapira
So there might be your answer - I guess nv stands for netvision - give them the URL and ask them to clear the cache for it. On 22 March 2015 at 05:56, Michael Tewner tew...@gmail.com wrote: I'm seeing the same thing, that is, the downloaded files start to differ at byte #4101 - The HTTPS

Re: Something is injecting malware into my HTTP traffic

2015-03-21 Thread Michael Tewner
I'm seeing the same thing, that is, the downloaded files start to differ at byte #4101 - The HTTPS version downloaded quite fast on my 5Mbps connection. The HTTP one is taking forever, quite literally; it's stalled - I've tried adding Cache-Control: no-cache and Pragma: no-cache, but