[Exim] system_filter

Hi List.

I am getting alot of mail containing the attachment photos.zip
and from the user james@<mydomain>

Reading TRENDS website, this conatins the virus MIMAIL

I have added the following line to the system_filter:

if $header_subject: contains "Re[2]: our private photos ???"
then
seen finish
endif

This does not filter the mail.

any help would be appreciated.

Regards,
Tom Kinghorn