Cat : So my guess is the point where the virus author slipped is not making the traffic to port 443 look like genuine HTTPS. The moment a firewall notices 443 and NOT HTTPS it is tell-telle sign of something.

Mouse: OK. see you next time.