This is a little hard to explain, so read slowly. I use a DNS caching program (FastCache by AnalogX) that caches DNS lookups. It includes a log showing all DNS lookups. When I close (not open) a web page with avast! 4.6 running, the FastCache icon shows that a DNS lookup has occurred. Remember, this is when closing a web page (IE6 on WinXP SP2). This was a little curious, so I looked in the FastCache log. It appears that some sort of lookups to various addresses are occurring. For example, a typical entry might be: 95.4.172.207.IN-ADDR.ARPA (I have never seen the IN-ADDR.ARPA in any other log entries). I have looked up the IP addresses in ARIN, and they don't appear to relate to anything on the web site I was viewing when I closed the browser. They seem to be IANA or RIPE reserved addresses (and some government ones), maybe DNS servers, but I don't know.
At first, I thought this was a strange interaction between avast! and FastCache, so I tried another DNS caching program, ExtraDNS. However, I get the same type of entries when closing web pages. But when I disable the avast! services, the DNS lookups do not occur when I close web pages, and the strange log entries stop occurring. Any thoughts?