Today, I have found the reason; it's the IPS:
2013:07:01-19:08:31 fw snort[5715]: id="2101" severity="warn" sys="SecureNet" sub="ips" name="Intrusion protection alert" action="drop" reason="MALWARE-OTHER HTTP POST request to a JPG file" group="500" srcip="192.168.11.13" dstip="85.115.22.9" proto="6" srcport="18712" dstport="80" sid="24103" class="Detection of a non-standard protocol or event" priority="2" generator="1" msgid="0"
UTM version is 9.006,
browser is FireFox (v22 now, but happens on previous versions as well)
on WinXP.
Barry