ZyXEL Communications VPN Series - What You Need to Know

Chapter 38 Anti-Virus
ZyWALL/USG Series User’s Guide
669
38.1.2 What You Need to Know
Anti-Virus Engines
Subscribe to signature files for Kaspersky’s anti-virus engine. After the trial expires, you need to
purchase an iCard for the anti-virus engine you want to use and register it in the Registration >
Service screen. You must use the Kaspersky anti-virus iCard for the Kaspersky anti-virus engine.
Virus and Worm
A computer virus is a small program designed to corrupt and/or alter the operation of other
legitimate programs. A worm is a self-replicating virus that resides in active memory and duplicates
itself. The effect of a virus attack varies from doing so little damage that you are unaware your
computer is infected to wiping out the entire contents of a hard drive to rendering your computer
inoperable.
ZyWALL/USG Anti-Virus Scanner
The ZyWALL/USG has a built-in signature database. Setting up the ZyWALL/USG between your local
network and the Internet allows the ZyWALL/USG to scan files transmitting through the enabled
interfaces into your network. As a network-based anti-virus scanner, the ZyWALL/USG helps stop
threats at the network edge before they reach the local host computers.
You can set the ZyWALL/USG to examine files received through the following protocols:
• FTP (File Transfer Protocol)
• HTTP (Hyper Text Transfer Protocol)
• SMTP (Simple Mail Transfer Protocol)
• POP3 (Post Office Protocol version 3)
• IMAP4 (Internet Message Access Protocol version 4)
How the ZyWALL/USG Anti-Virus Scanner Works
The following describes the virus scanning process on the ZyWALL/USG.
1 The ZyWALL/USG first identifies SMTP, POP3, IMAP4, HTTP and FTP packets through standard ports.
2 If the packets are not session connection setup packets (such as SYN, ACK and FIN), the ZyWALL/
USG records the sequence of the packets.
3 The scanning engine checks the contents of the packets for virus.
4 If a virus pattern is matched, the ZyWALL/USG removes the infected portion of the file along with
the rest of the file. The un-infected portion of the file before a virus pattern was matched still goes
through.
Note: If a virus pattern is matched, the ZyWALL/USG removes the infected portion of the file along
with the rest of the file. The un-infected portion of the file before a virus pattern was
matched still goes through.
Since the ZyWALL/USG erases the infected portion of the
file before sending it, you may not be able to open the file.