I just wanted Symantec to look into this... it seems like merely doing a google search for a specific term prompts a "HTTP Malicious Toolkit Variant Activity" on my computer. NIS 2009 stopped it, but it's weird that Google is doing this.
I realize this is a drive by download becase while the attacker URL is not related to my computer, it says my computer is the attacking computer and source address. It also lists the website as the destinationa address. I remember reading on these posts that people have had problems with this meta data and that the issue is being fixed.
If any employee wants the search query, I can PM it to you. Thanks!