Nowadays Antivirus software often includes a Webscanner, even free ones... The webscanner scans the tcp stream on the fly and may stop (or modify?) it. Perhaps he is sending back - over non anonymous channels - for "remote analysis"? Do you think legit Antivirus software may compromise anonymity? Any known examples yet?