Cunning phishing

Question

Phishing

Javascript is embedded in popular pages (for example, vk.com, fb.com) (at the end of the code) and draws a frame over the content of the page itself, in which it offers to receive SMS and enter the code. The address from which this script is taken: htntrailzip.com
After I entered the name of this site in hosts and assigned it 127.0.0.1, almost all pages stopped loading.
Question: where is that muck that embeds this script at the end of the page?
How to treat it?

Answer 1

I suggest just banish combofix - 95% that he will kill him and / or use avz

Answer 2

Can you send the full page code with a link to htntrailzip.com? It is very necessary from a live machine.
The infection sits in appinit_dlls, a library with a random name, or 105.tmp in some cases.