Spoke with our security guys, and apparently
VBS/Virus.invadesys was being detected. Probably a bad virus signature, or maybe one of the ads.
I was seeing this earlier:
But only for the bare domain http://serverfault.com, everything else was working, including https://serverfault.com/questions, https://serverfault.com/users, etc. The "File Name:" portion would randomly change to "questions" "favicon.ico" and "" (blank) when refreshing.
The blocked page wasn't coming from our web filter, it doesn't do "Virus Download Blocked". Our "page blocked" messages are served from our LightSpeed's address. I ran wireshark to investigate the "Virus Download Blocked" content and the IP (sorry didn't save the cap) resolved to "stackoverflow.com".
Shortly after the "blocked" message disappeared [maybe 25 minutes of mashing crtl+shift+r repeatedly] http://serverfault.com would not load at all. This appeared to only affect logged in SE accounts. A coworker logged out of SE and was able to load the front page. I went off a did some Real Work, by the time I was done, the front page was loading as a logged in user.
Just for fun, I blame Bart. :)