Getting “we detected malicious activity from your network” in Google

Question

I've been recently getting captchas when doing Google searches. I searched everyone's computer and netstat didn't return anything relevant from a cursory glance, and there was no idle networking peak.

Then I looked at my computer. No constant network traffic, but in netstat I have a constant connection to one of Google's IP address. Well, not just one, but I have at times 15 established connections to Google IP addresses, when no other programs are running but Firefox(though not on any Google page)(also, the PID reported is Firefox)

I've disabled all add-ons in Firefox and this is beginning to look like a Firefox bug.. if this is a bad enough reason to get marked as malicious by Google.

Anyway, it will begin the constant established connection only when I use the quick search feature in either the URL bar or the search bar to the right of it.

Does anyone know if Firefox was always like this, or if this is an actual bug?

Answer 1

Are you sure it's a problem with firefox? Does it happen under other browsers too?

Answer 2

In essence these things are mostly due to some sort of malware working in your network (usually /24, which, in some ISP may or may not be your network, and sometimes it may even not be your neighbours...) which accesses google and manipulate the search result (this is a big, big thing in malware business)

Note: Google had a page for it (Reformatted to suit here, delete if admins think that a link shall suffice)

Excerpt from http://www.google.com/support/websearch/bin/answer.py?hl=en&answer=86640:

1. Check for malware on your computer.

   Malicious software, sometimes bundled with other free downloads without your knowledge, can trigger Google to show this message. We've suggested some well-known programs below that can detect and remove such applications. Please remember that we have no connection with these companies and can't guarantee their effectiveness.

   • Google Pack
   • The Starter Edition of Spyware Doctor is included free with the Google Pack Sunbelt Software CounterSpy
   • Kaspersky Lab Internet Security
   • Norton Internet Security

   • MacScan (for Mac users)

     If these programs don't resolve the problem, you might want to try an advanced troubleshooting program such as HijackThis.

2. Contact your network administrator.

   If you tried the steps above and haven't resolved the issue, it's very likely that a user or a computer in your network is sending automated traffic to Google. Your network administrator may be able to locate and shut down the source of the automated traffic; feel free to refer them to this page. Sending automated queries of any sort to Google is against our Terms of Service. This includes, among other things, the following activities: * Using any software that sends queries to Google to determine how a website or webpage ranks on Google for various queries * 'Meta-searching' Google * Performing 'offline' searches on Google

   Once the automated traffic has stopped, the ban on your IP address should be automatically lifted.

3. If the problem persists, your network administrator should contact us.

   If your network continues to experience this message in error, please send us additional information.