1. When incomming email arrive the filter check it with AVG Antivirus (or AVG Free edition).
2. Search for a coincidence between email subject and MSBL.TXT
3. Search for a BANLIST.TXT (sub)domain in real (SMTP) and email (From:) sender addresses.
4. Extract all mail servers crossed by the email from their header.
5. Check every not trusted and not local mail servers with every configured DNSBL server.

If any check detect a SPAM/VIRUS email the proccess is stoped and the incomming email is rejected/deleted.