Hi grml4d,
When I spoke to Zyxel Support for help configuring the UTMs, they explained that the Anti Virus policy should be applied to "out going" rules.
The router will then scan the traffic when a device on your network accesses the internet. If your device goes to an infected site/server...
Hmm, no sure about the browser timeout issue, haven't had that promlem on mine.
Can't tell from your screenshot if your setup is correct, cause you only included the anti-virus policy, but not the security policy.
These are the settings on my box and its working.