User Guide - Kaspersky Lab

264 Kaspersky Internet Security 7.0
is monitored by Web Anti-Virus. To analyze this traffic for malicious code, you
can add this port to a list of controlled ports.
When any of its components starts, Kaspersky Internet Security opens port 1110
as a listening port for all incoming connections. If that port is busy at the time, it
selects 1111, 1112, etc. as a listening port.
If you use Kaspersky Internet Security and another company’s firewall
simultaneously, you must configure that firewall to allow the avp.exe process (the
internal Kaspersky Internet Security process) access to all the ports listed above.
For example, say your firewall contains a rule for iexplorer.exe that allows that
process to establish connections on port 80.
However, when Kaspersky Internet Security intercepts the connection query
initiated by iexplorer.exe on port 80, it transfers it to avp.exe, which in turn
attempts to establish a connection with the web page independently. If there is
no allow rule for avp.exe, the firewall will block that query. The user will then be
unable to access the webpage.
19.6. Scanning Secure Connections
Connecting using SSL protocol protects data exchange through the Internet. SSL
protocol can identify the parties exchanging data using electronic certificates,
encrypt the data being transferred, and ensure their integrity during the transfer.
These features of the protocol are used by hackers to spread malicious
programs, since most antivirus programs do not scan SSL traffic.
Kaspersky Internet Security 7.0 has the option of scanning SSL traffic for viruses.
When an attempt is made to connect securely to a web resource, a notification
will appear on screen (see Figure 111) prompting the user for action.
The notification contains information on the program initiating the secure
connection, along with the remote address and port. The program asks you to
decide whether that connection should be scanned for viruses:
• Process – scan traffic for viruses when connecting securely to the
website.
We recommend that you always scan SSL traffic if you are using a
suspicious website or if an SSL data transfer begins when you go to the
next page. It is quite likely that this is a sign of a malicious program being
transferred over secure protocol.
• Skip – continue secure connection with the website without scanning
traffic for viruses.