Hi, WebShield blocks the connection as soon as the virus is detected. In ZIP files, where the directory of the zip container is at the end and the end of the file is needed for unpack, the detection is actually only possible once almost whole archive has been downloaded.
When the file is small, all works as you expect, the content is found and stopped. When the file is larger, the start might have already been delivered to the browser.
Have you tried to open the zip? Since not whole file is downloaded by the browser, the content should actually be corrupted and impossible to open as a zip file. Some browser is such case (aborted download) don't save anything - since it was aborted before the end, other browsers save what they have. In any case, the file saved shouldn't be complete.