To block the ICQ , you have to do two steps :- 1-To make a protocol rule that denies access to the ICQ port (check your services file to know the exact port for your ICQ version). 2-However this is not enough as the ICQ program trying another dynamic port if it finds the original port is blocked behind a firewall so you have to implement a site and content rule that denies the access to the *.icq.com site. if you do both steps you will be safely denies access to ICQ.