Google Message Security for Google Apps Administration Guide - Manual (Page 188)

188 Message Security for Google Apps Administration Guide
Attachment Scanning
Virus Blocking scans messages for both complete and incomplete MIME headers
(MIME headers as separate attachments from the rest of the content of an email
message). Next, Virus Blocking opens and scans uncompressed and
unencrypted files. Compressed file attachments are opened and recursively
scanned.
Attachment Manager offers an additional layer of protection against zero-hour
threats, as you can set policies to catch all executables, and you can configure
Attachment Manager to bounce or quarantine system threats. Attachment
Manager can filter password-protected ZIP files and other compressed
attachments separately from standard compressed files.
For more details, see “ Attachment Manager” on page 271.
About Virus Blocking
Viruses, when detected, can either be deleted, quarantined in a user or
administrator quarantine, or tagged as viruses in the message email headers.
Virus Blocking can be configured for incoming and outgoing messages. Contact
your account manager to check whether your message security service package
includes outgoing message support.
When Virus Blocking Occurs
During message processing, messages are filtered by Connection Manager
(attack protection), Content Manager, Senders Lists, and Junk Filters. Virus
Blocking then scans the messages and attachments for viruses. Clean messages
are passed along to Attachment Manager so they can be filtered according to your
attachment policies. As a last step, messages are passed to Early Detection
Filtering so that any zero-hour threats can be stopped.