[Exim] sophos av_scanner syntax to detect password protected

Just wondering for those of you using sophos command line to scan, what
syntax you are using to bounce password protected zip files?

I currently have:

av_scanner = cmdline: /usr/local/bin/sweep -all -archive -ss %s:\
        found:'(.+)'

Derrick MacPherson
derrick@???