Zyxel ZyWALL 1100 [519/829] What you need to know

Chapter 31 Anti-Virus

ZyWALL/USG Series User’s Guide

519

31.1.2 What You Need to Know

Anti-Virus Engines

Subscribe to signature files for Kaspersky’s anti-virus engine. After the trial expires, you need to

purchase an iCard for the anti-virus engine you want to use and register it in the Registration >

Service screen. You must use the Kaspersky anti-virus iCard for the Kaspersky anti-virus engine.

Virus and Worm

A computer virus is a small program designed to corrupt and/or alter the operation of other

legitimate programs. A worm is a self-replicating virus that resides in active memory and duplicates

itself. The effect of a virus attack varies from doing so little damage that you are unaware your

computer is infected to wiping out the entire contents of a hard drive to rendering your computer

inoperable.

ZyWALL/USG Anti-Virus Scanner

The ZyWALL/USG has a built-in signature database. Setting up the ZyWALL/USG between your local

network and the Internet allows the ZyWALL/USG to scan files transmitting through the enabled

interfaces into your network. As a network-based anti-virus scanner, the ZyWALL/USG helps stop

threats at the network edge before they reach the local host computers.

You can set the ZyWALL/USG to examine files received through the following protocols:

• FTP (File Transfer Protocol)

• HTTP (Hyper Text Transfer Protocol)

• SMTP (Simple Mail Transfer Protocol)

• POP3 (Post Office Protocol version 3)

• IMAP4 (Internet Message Access Protocol version 4)

How the ZyWALL/USG Anti-Virus Scanner Works

The following describes the virus scanning process on the ZyWALL/USG.

1 The ZyWALL/USG first identifies SMTP, POP3, IMAP4, HTTP and FTP packets through standard ports.

2 If the packets are not session connection setup packets (such as SYN, ACK and FIN), the ZyWALL/

USG records the sequence of the packets.

3 The scanning engine checks the contents of the packets for virus.

4 If a virus pattern is matched, the ZyWALL/USG removes the infected portion of the file along with

the rest of the file. The un-infected portion of the file before a virus pattern was matched still goes

through.

Note: If a virus pattern is matched, the ZyWALL/USG removes the infected portion of the file along

with the rest of the file. The un-infected portion of the file before a virus pattern was

matched still goes through.

Since the ZyWALL/USG erases the infected portion of the

file before sending it, you may not be able to open the file.