@dolphins,
Now, your screenshot doesn't show the full name of the .exe file you put there, I guess it's the same as in the rule name.
AvastEmUpdate needs a connection as you're coding it. Just put it in the right place.
The randomName.exe file does not need the internet connection, at least not for me. It gets downloaded when emergency update sees one is required. It is then run.
It causes some firewalls to alert because its name changes so HIPS or behavior blocking sections of a firewall respond, not the packet rules.
On the other hand, if you look into the Outpost forum thread I posted, you will see that there was an alert for both behavior and connection for the randomName.exe. So I guess every firewall alerts slightly differently or sees different events, and also it may well be related to what sort of HIPS/behavior settings one has. I don't have that option, so every new .exe causes a prompt.
Are you sure the alert you get from Kerio is for the randomNamed.exe? The one you posted originally is just for the emergency update.
This is off-topic: You may want to put port 80 into the remote port, also limit your local ports to 1029-5000 if on XP, some other range for newer Windows.