[Exim] Problem with and condition in ACL

I'm trying to write a DATA ACL which will reject mail that contains no
Message-ID header but has "X-MailScanner: Found to be clean" in order to
deal with W32.Sobig.F.

deny    condition = ${if and{{def:h_message-id:{false}{true}} \
                             {match{$h_x-mailscanner:}{Found to be clean}}} \
                             {true}{false}}
        log_message = X-MailScanner header with no Message-ID. Probably \
                      W32.Sobig.F

However this results in a "temporarily rejected after DATA: failed to expand
ACL string "${if and{{def:h_message-id:{false}{true}}
{match{$h_x-mailscanner:}{Found to be clean}}} {true}{false}}": missing } at
end of condition inside "and" group" error when I test it.

I've stared at this for quite a while and I'm just not seeing the mistake.
What am I missing?

Thanks,

Tabor

--
--------------------------------------------------------------------
Tabor J. Wells                                     twells@???
Fsck It!                 Just another victim of the ambient morality