What You Need To Know - ZyXEL Communications ZyWALL USG 50 User Manual

Chapter 29 Anti-Virus

29.1.2 What You Need to Know

Anti-Virus Engines
Subscribe to signature files for Kaspersky's anti-virus engine. After the trial
expires, you need to purchase an iCard for the anti-virus engine you want to use
and register it in the Registration > Service screen. You must use the Kaspersky
anti-virus iCard for the Kaspersky anti-virus engine. See
for details.
Virus and Worm
A computer virus is a small program designed to corrupt and/or alter the
operation of other legitimate programs. A worm is a self-replicating virus that
resides in active memory and duplicates itself. The effect of a virus attack varies
from doing so little damage that you are unaware your computer is infected to
wiping out the entire contents of a hard drive to rendering your computer
inoperable.
ZyWALL Anti-Virus Scanner
The ZyWALL has a built-in signature database. Setting up the ZyWALL between
your local network and the Internet allows the ZyWALL to scan files transmitting
through the enabled interfaces into your network. As a network-based anti-virus
scanner, the ZyWALL helps stop threats at the network edge before they reach the
local host computers.
You can set the ZyWALL to examine files received through the following protocols:
• FTP (File Transfer Protocol)
• HTTP (Hyper Text Transfer Protocol)
• SMTP (Simple Mail Transfer Protocol)
• POP3 (Post Office Protocol version 3)
• IMAP4 (Internet Message Access Protocol version 4)
How the ZyWALL Anti-Virus Scanner Works
The following describes the virus scanning process on the ZyWALL.
The ZyWALL first identifies SMTP, POP3, IMAP4, HTTP and FTP packets through
1
standard ports.
If the packets are not session connection setup packets (such as SYN, ACK and
2
FIN), the ZyWALL records the sequence of the packets.
470
Section 10.1 on page 213
ZyWALL USG 50 User's Guide