So, I have a connection from my Linux-64-tor-2.6.3 TBB browser to an entry node in a foreign country. That country is a very long way from here. The node is running the latest Tor, so it's using a ECDHE* (supposedly strong) encryption cipher suite. I look at netstat, and see only the 443 connection from here to the foreign node. While Tor appears to be working OK, I see that junk is injected into my pages (nasty stuff). I believe the junk may come from a local hostile environment. I did not accept any additional certificates. So, if it's really local, what's the most likely scenario:
1) The ECDHE_RSA_WITH_AES256 suite can be broken on the fly (very quickly)?
2) The certificates for the Tor node are manipulated/compromised?
3) I have somehow been compromised with a trojan, in spite of only using the single encrypted Tor pipe to the foreign node, and having made a fresh OS install immediately prior to that?
4) Your choice