Google Message Security for Google Apps Administration Guide - Manual (Page 197)

Virus Blocking 197
Resolution: As necessary, configure a different disposition, or configure your
mail server to dispose of all messages that contain the custom header
X-
pstn-virus .
3. If the Virus Disposition is set to User Quarantine or Quarantine Redirect,
check whether the recipient of the message has a user account.
a. Click the Users tab and enter the address in the Find User field.
b. Click Search to determine if the user exists.
c. If the user does exist, click its address, then click Virus Blocking to make
sure that Virus Blocking is On.
d. If the user does not exist, perform the resolution below. Otherwise,
continue to the next step.
Resolution: Create a user account for the email address, or add it as an alias
to the already existing primary user account.
At this point, you have confirmed that virus filtering is configured properly. The
following steps show you how to proceed in this case:
1. Check whether the virus has been recently discovered by McAfee or
Authentium:
The email may contain a virus that the virus engine did not know about. There
is a lag time between the initial outbreak of a virus and the implementation of
an update to the antivirus definition file that allows the virus protection engine
to detect (and thus quarantine) the virus. This time is usually very short.
During this time, new viruses may not be detected by virus blocking.
a. If you do not know the McAfee and Authentium names for the virus,
search the Internet for the name of the virus. Searching should include
web sites for any other virus protection software you use. This often
shows you the McAfee and Authentium names for the virus. If not, then
use common search engines using other names for the virus.
b. Search the McAfee web site for the name of the virus; this tells you if/
when the antivirus definition files provided by McAfee first protected you
from this virus.
http://vil.nai.com
c. If your service package includes Authentium Antivirus, also check
Authentium to find out when it first protected you from this virus.
http://www.authentium.com/support/AVMatrix/portal.aspx
d. If the date of the message is before the protection date and time, then
follow the resolution below. Otherwise, proceed to the next step.
Resolution: This is the source of the virus delivery. No further analysis is
required, and McAfee or Authentium has the definition on record.
2. Check the file size of the virus attachment.