Do you have the .zip extension configured to be scanned on open? (second page of the standard shield configuration) - by default only .wsh files are scanned on open, if i remember correctly.