Well it’s the MS Proxy/ISA provider. It filters HTTP/FTP stuff going through the ISA server.
Like this link (benign): http://www.eicar.org/download/eicar.com (you shouldn’t be able to access this location if the filter is active).
Thanks Vlk