When downloading over the web small files are blocked with a block page. Larger files are treated differently. They are fed to the client at a slower rate than they are actually downloaded so the client does not time out while the download happens. After NG Firewall scans the complete file it will either refuse to send the rest if there is a virus or immediately send the rest. This means for large files the Event Log says the file is "blocked", but checking the file size on the client will show that you do not actually have the complete file.

While Untangle is scanning the attachments your email server is still waiting for the message, most likely triggering a timeout setting. If you're using MS Exchange, you'll want to increase the Connection Inactivity Timeout setting.

If you have both virus scanners installed, Virus Blocker is applied to a message first: if a message passes Virus Blocker, then and only then is Virus Blocker Lite applied to the message (there's no point in scanning the message twice if the first scanner has rejected it).

This is not to say one scanner is inherently better than the other: note that Virus Blocker is complemented by Virus Blocker Lite and in the case of a virus-free message, the computational overhead of the virus scan includes both scanners. A message that would be rejected by both scanners incurs the computational and time cost of just Virus Blocker.

To perform a valid comparison, you should run test messages through the NG Firewall with no scanners installed, Virus Blocker by itself, Virus Blocker Lite by itself and lastly both scanners installed together and compare the results.

Yes.

With your NG Firewall's Virus Blocker(s) active, they will scan inbound and outbound HTTP, FTP and Email traffic as it passes through the Untangle. This is your first layer of protection. Imagine this scenario:

In this scenario the file was transferred without going through Untangle. If Angela had emailed the file to her coworkers work email accounts from her personal email account, that email would have passed through the NG Firewall, which would prevent the virus from entering your protected network. Because of situations like this, we always recommend an additional layer of protection on the desktop.

Virus Blocker is based on the Bitdefender AV Engine, which is consistently in the top 10 for detecting zero-hour threats. Virus Blocker Lite is based on Clam AV, the well-respected open source virus scanner.