ZyXEL Communications 1000 Benutzerhandbuch

 Chapter 33 Anti-Virus

ZyWALL USG 1000 User’s Guide

If the packets are not session connection setup packets (such as SYN, ACK and 
FIN), the ZyWALL records the sequence of the packets.

The scanning engine checks the contents of the packets for virus. 

If a virus pattern is matched, the ZyWALL removes the infected portion of the file 
along with the rest of the file. The un-infected portion of the file before a virus 
pattern was matched still goes through. 

If the send alert message function is enabled, the ZyWALL sends an alert to the 
file’s intended destination computer(s). 

Note: Since the ZyWALL erases the infected portion of the file before sending it, you 

may not be able to open the file.

The following lists important notes about the anti-virus scanner:

The ZyWALL anti-virus scanner can detect polymorphic viruses.  

When a virus is detected, an alert message is displayed in Microsoft Windows 
computers. Refer to 

 if your Windows computer does not 

display the alert messages.

Changes to the ZyWALL’s anti-virus settings affect new sessions (not the sessions 
that already existed before you applied the changed settings).

The ZyWALL does not scan the following file/traffic types:

• Simultaneous downloads of a file using multiple connections. For example, 

when you use FlashGet to download sections of a file simultaneously.  

• Encrypted traffic. This could be password-protected files or VPN traffic where 

the ZyWALL is not the endpoint (pass-through VPN traffic). 

• Traffic through custom (non-standard) ports. The only exception is FTP traffic. 

The ZyWALL scans whatever port number is specified for FTP in the ALG 

screen.

• ZIP file(s) within a ZIP file. 

• See 

 for related information on these screens.

• See 

 for anti-virus background information.