Notes About The Zywall Anti-Virus; Figure 313 Zywall Anti-Virus Example - ZyXEL Communications Unified Security Gateway ZyWALL 1000 User Manual

Figure 313 ZyWALL Anti-virus Example

The following describes the virus scanning process on the ZyWALL.
1 The ZyWALL first identifies SMTP, POP3, IMAP4, HTTP and FTP packets through
standard ports.
2 If the packets are not session connection setup packets (such as SYN, ACK and FIN), the
ZyWALL records the sequence of the packets.
3 The scanning engine checks the contents of the packets for virus.
4 If a virus pattern is matched, the ZyWALL removes the infected portion of the file along
with the rest of the file. The un-infected portion of the file before a virus pattern was
matched still goes through.
5 If the send alert message function is enabled, the ZyWALL sends an alert to the file's
intended destination computer(s).
Since the ZyWALL erases the infected portion of the file before sending it, you
may not be able to open the file.

28.2.2 Notes About the ZyWALL Anti-Virus

The following lists important notes about the anti-virus scanner:
1 When a virus is detected, an alert message is displayed in Microsoft Windows
computers.
2 The ZyWALL does not scan the following file/traffic types:
• Simultaneous downloads of a file using multiple connections. For example, when you
use FlashGet to download sections of a file simultaneously.
4. Refer to
ZyWALL USG 1000 User's Guide
4
Appendix D on page 707 if your Windows computer does not display the alert messages.
Chapter 28 Anti-Virus
405