Mailsweeper relies on address list definitions to provide direction and policy selection. Therefore, address lists have to be both accurate and comprehensive for policies to be executed as intended. During the installation of Mailsweeper 4.0, the installshield program asks for your email domain. This should be considered your organization's primary domain. The installshield application creates definitions for the Incoming and Outgoing folders using this primary domain.
Some organizations receive mail for multiple domains.
If a message is received inbound that uses an alternate domain or subdomain, it will not match the incoming definition and therefore will hit the generic Scenarios folder. Since some people add a Virus Manager scenario to the Incoming folder, the Scenarios parent folder will not contain the Virus Manager policy. In this situation, mail sent with a virus to a domain that isn't defined in the addresses lists as your company, will pass through the Mailsweeper as Clean. There are a few ways you can fix this issue. Add the appropriate domains or subdomains to the address list that corresponds to your company name.