It seems that kaspersky update servers are reported as application="kasprsky" [:)]
example :
2012:02:08-22:34:08 ***** httpproxy[27641]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="GET" srcip="*****" dstip="95.211.85.42" user="" statuscode="200" cached="0" profile="REF_CnNPwVRtng (Internal Users)" filteraction="REF_DefaultHTTPCFFBlockAction (Internal Users)" size="2846" request="0xc6ed0740" url="dnl-03.geo.kaspersky.com/.../octet-stream" application="kasprsky"
Thanks
This thread was automatically locked due to age.