Google Message Security for Google Apps Administration Guide - Manual (Page 189)

Virus Blocking 189
The Virus Blocking disposition has precedence over other filter dispositions.
When Virus Blocking is enabled:
• All messages that are either quarantined by a filter or pass through all the
filters are scanned for viruses. If a message contains a virus, it is processed
according to the virus disposition. For example, if a message has been
quarantined by the Junk Filter because of spam content, but the message
also contains a virus, then the message is processed according to your Virus
Blocking settings (e.g., the message could be deleted instead of placed in the
user’s quarantine).
• All message attachments are scanned and processed for viruses, regardless
of whether Attachment Manager filtering is enabled.
• No Approved Senders, Attachment Manager, or Content Manager rule can
override Virus Blocking to deliver a message. Even if the message is from an
approved sender, the message is scanned for viruses.
See “Message Processing Order” on page 36 for details.
• When a statistically significant quantity of virus messages is quarantined from
an IP, the Connection Manager will block the sending IP as a Virus Outbreak.
Order of Virus Filtering
For most customers, all incoming messages are first scanned by the McAfee
Antivirus engine. The Authentium Antivirus engine then scans all inbound
messages that are determined to be clean by the McAfee antivirus engine. The
message service checks for virus definition updates every minute from both
McAfee and Authentium.
For customers added after June 2007 on System 20 and System 7, the message
service scans all incoming messages first with the Authentium Antivirus engine,
and then all clean messages are scanned again by McAfee. This change of order
is for optimization and measurement purposes, and does not alter the
effectiveness of your anti-virus protection in any way. All messages continue to be
scanned by two engines before delivery to your inbox.
Virus Definition File Updates
Virus Blocking updates the antivirus definition files for its McAfee Antivirus engine
and Authentium Antivirus engine every minute. This information is for your
reference only. You do not need to take any action to receive the benefits of the
message security service’s definition-file updates. The following sections outline
the update details.