My computer has been a target of a Man-in-the-Middle attack. When I am using the same site for more than 5-10 minutes, occasionally that website gets replaced by a compromised website for a couple hours. Since I am using HTTPS, I immediately detect the attack, since the certificate is suddenly self-signed-- and I avoid sending sensitive data; however, the attacks have been getting more sophisticated lately. Furthermore, I need to be able to continue my work-- I need to be able to connect to the original website somehow.
One odd thing is, that this attack is browser-specific. For example, when eBay.com has been compromised on Firefox, it continues working on Opera. However, after 5 minutes of working on Opera, it is compromised there too; but switching to IE allows me to continue working for another 15-20 minutes. It is never compromised when I am accessing it via command line (presumably to prevent me from using tools such as tracert).
I have been able to obtain my system administrator's password, and admittedly it is only a moderately strong password; and, the router allows remote control; so possibly, the router has been hacked. I can change the router password; but first, I would like to confirm where the attack is coming from. Because if I don't, and the attacker detects my attempts to thwart him, then he can stop for a time, to make me think I've found where the problem is coming from, when I actually haven't.