Google Message Security for Google Apps Administration Guide - Manual (Page 185)

Chapter 10
Virus Blocking 185
Virus Blocking
Chapter 10
Levels of Protection
Your message security service offers multiple levels of protection against viruses,
including the use of virus-detection engines, early-detection filtering, protection
against zero-hour threats, and antivirus heuristics. This section describes each
level of protection.
Olympus Library of Virus Definitions
Google works as an Antivirus Development Partner with McAfee, and uses the
same technology employed in McAfee Antivirus software to develop the Olympus
library of virus definitions.
Incoming email is first scanned for viruses by the McAfee antivirus engine.
Authentium Antivirus Engine
The message security service also checks every minute for virus definition
updates from Authentium.
Any incoming email that is determined to be virus free by the Olympus library is
subjected to a second scan from the Authentium Antivirus engine.
Early Detection Filtering
Even though your message security service checks for new antivirus-definition file
updates every minute, there is always some delay between the discovery of a
virus and its inclusion in a definition file. Live viruses that have not been included
in definition files are referred to as zero-hour threats.
When you turn on Early Detection Filtering, a message that is not immediately
identifiable as virus infected but has an executable file attached, is sequestered in
the Early-Detection Quarantine.