A firewall can use packet inspection to open each network packet and read the data inside. If it finds the signature of a virus inside, then it can remove or prevent the packet entering the network.