Why is Google prompting me with Captchas?

Question

Why is Google prompting me with Captchas?

I turned on urlsnooper2 and found this (below). I don't know why my computer would request any of it. What I changed in the past few days is:

1. Reformatted my computer (unpatched at the moment, hidden behind Windows Firewall and a router)
2. Firefox 4
3. Let a friend who has a messed up computer on my network

I'm pretty much disqualifying item 3 because I see the request below. I doubt a browser would cause the problem. So did I get a virus because I didn't patch? I doubt that too because: How could I receive it? I checked out services and startup programs with the "msconfig" utility and it's clean.

www.google.com
http://www.google.ca
http://www.google.ca/webhp?hl=en&tab=ww
http://www.google.ca/imghp?hl=en&tab=wi
http://video.google.ca/?hl=en&tab=wv
http://maps.google.ca/maps?hl=en&tab=wl
http://news.google.ca/nwshp?hl=en&tab=wn
http://books.google.ca/bkshp?hl=en&tab=wp
http://mail.google.com/mail/?hl=en&tab=wm
http://www.google.ca/intl/en/options
http://www.google.ca/finance?hl=en&tab=we
http://translate.google.ca/?hl=en&tab=wT
http://scholar.google.ca/schhp?hl=en&tab=ws
http://blogsearch.google.ca/?hl=en&tab=wb
http://www.google.ca/realtime?hl=en&tab=wY
http://www.youtube.com/?hl=en&tab=w1&gl=CA
http://www.google.com/calendar?hl=en&tab=wc
http://picasaweb.google.ca/home?hl=en&tab=wq
http://docs.google.com/?hl=en&tab=wo
http://www.google.ca/reader/?hl=en&tab=wy
http://sites.google.com/?hl=en&tab=w3
http://groups.google.ca/grphp?hl=en&tab=wg
http://74.125.226.48/url?sa=p&pref=ig&pval=3&q=http://www.google.ca/ig%3Fhl%3Den%26source%3Diglk&usg=AFQjCNG2Kt7TgMZuV7Fl3FeeTOmTWMvggA
https://www.google.com/accounts/ServiceLogin?hl=en&continue=http://www.google.ca
http://192.168.1.107:2869/upnphost/udhisapi.dll?content=uuid:eb668ce6-7149-4420-87d0-b7d0ab5dcbab
http://schemas.upnp.org/upnp/1/0

Answer 1

Google requires captchas when it receives a large amount of traffic from one IP address... your friend more than likely has something that is querying Google non-stop for whatever reason or maybe trying to brute-force a gMail account.

It could also be that someone that had the IP you have right now was querying and triggered it then you were assigned the IP via DHCP.

If you want them to stop you need to get a different IP address... depending on your network setup you may want to either disconnect the internet overnight and hopefully you get a new IP assigned when you reconnect or change the MAC address of your router so you are assigned a new one right away. You should also clear all your browser just to be safe not sure if they track it through cookies.

Answer 2

"Let a friend who has a messed up comp on my network".
You answered your question right there. His comp probably has a bot, if it's that messed up, and (the all-powerful) Google probably remembered your subnet addr. and is screening all comps from that net.

I don't think you have a virus/bot, if you did, i would think that the urls might be more suspicious-looking than that, though the google.com/accounts/ServiceLogin? listing might be a little suspicious, though I wouldn't go red alert on a little thing like that. That url might have been you logging into your account or something.

EDIT: @Aaron reminded me of something that you should do also, just to make sure you are not rooted. Use the DOS command netstat -n like he suggested, and I would also reccomend downloading Nmap (the link here is for the GUI, ZeNmap - my personal favorite) to scan localhostto see which ports are open on your computer

Answer 3

You could always check what connections your computer is making. You might find something fishy:

netstat -a -n