Using the FPCCacheContents Object I was able to force-cache any file I wanted for any duration I wanted.
1. I downloaded Cain&Abel executable from source #1 and Kaspersky blocked it. I verified that traffic was coming from souce #1 with Wireshark.
2. I force-cached Cain&Abel executable from source #2 to avoid IE caching or anything that might invalidate this test. The item now exists in ISA cache.
3. I downloaded Cain&Abel executable from source #2 again. I verified that traffic was indeed coming from ISA Cache with Wireshark.
I turned up KAV log files to Debug and verified that the Cain&Abel executable has not been flagged the first time it was downloaded. Kaspersky blocked Cain&Abel from ISA Cache.
Conclusion:
- HTTP Kaspersky engine interfaces with cache and routed requests.
- Anything can be forced into ISA cache.
See the ISA Monitor Utility for cache control. http://sync-io.net/IsaTools.aspx