When Symantec Messaging Gateway scans a message with a suspicious attachment, it places the message into Suspect Virus Quarantine.
To use Suspect Virus Quarantine, your malware policy must use one of the following actions for suspicious attachments:
Hold message in Suspect Virus Quarantine
Strip and Delay in Suspect Virus Quarantine
Messages remain in Suspect Virus Quarantine until one of the following conditions occur:
The message is held in quarantine for the specified time.
You can specify how long you want to retain messages with suspicious attachments in quarantine. The default value is 6 hours.
You retain messages in quarantine to give Symantec time to release updated virus definitions with which to rescan the message. If Symantec Messaging Gateway rescans the message with updated definitions, but still deems the attachment suspicious, it returns the message to Suspect Virus Quarantine. The cycle continues until the message meets one of the conditions that are described in this table to be released from quarantine.
Note: If you modify the default value, ensure that you allow adequate time for Symantec Messaging Gateway to download the latest antivirus definitions.