[exim] Malware acl condition: sophie reported error

I wonder if you esteemed gentlemen can shed a light on this little problem for
me.

I have just built some new mail servers using Exim 4.60 and Sophie 3.05
(previous versions were old :-) )
I am periodically getting

malware acl condition: malware acl condition: sophie reported error

reports in my logs (sometimes several per minute).
Virus scanning is apparently working, they are getting recognised, but I
suspect
the problem has something to do with Mime attachments. Messages that trigger
this error report
get a temporary failure status, which means I could get to see them all over
again, repeatedly :-(

I can't find any info in the list archives or wiki, the scanning code from
malware.c in the exim source is

-----------------------
      /* infected ? */
      if (av_buffer[0] == '1') {
        if (Ustrchr(av_buffer, '\n')) *Ustrchr(av_buffer, '\n') = '\0';
        Ustrcpy(malware_name_buffer,&av_buffer[2]);
        malware_name = malware_name_buffer;
      }
      else if (!strncmp(CS av_buffer, "-1", 2)) {
        log_write(0, LOG_MAIN|LOG_PANIC,
             "malware acl condition: malware acl condition: sophie reported
error");
        return DEFER;
      }
      else {
        /* all ok, no virus */
        malware_name = NULL;
      };
-----------------------

Which implies sophie has returned a -1 status code. My Mime ACL looks like

-----------------------
check_mime:

# Too many MIME parts
#
  deny
  condition      = ${if >{$mime_part_count}{1024}{yes}{no}}
  message       = Too many MIME parts (max 1024)
  log_message = DENY: MIME Error (Too many MIME parts: $mime_part_count)

# Excessive line length
#
  deny
  regex       = ^.{1024}
  message     = MIME error: Line length in message or single header exceeds
1024.
  log_message = DENY: MIME Error (Maximum line length exceeded)

# Partial message
#
  deny
  condition   = ${if eq {$mime_content_type}{message/partial}{yes}{no}}
  message     = MIME error: MIME type message/partial not allowed here
  log_message = DENY: MIME Error (MIME type message/partial found)

warn decode = default

  deny message = This message has been rejected because it has\n\
      \ta prohibited file extension (${extract{-1}{.}{${lc:$mime_filename}}})
   log_message= Rejected due to potential executable content
(${extract{-1}{.}{${lc:$mime_filename}}})
   condition       = ${if
match{${extract{-1}{.}{${lc:$mime_filename}}}}{\N^(BAD_ATTACHMENTS)$\N}{1}{0}}

accept


#!!# ACL that is used after the DATA command

check_message:

  # Reject virus infected messages.
  #Add a header to show that message has been virus scanned
  warn     message    = X-Virus-Scanned: Cardiff University Sophos AV
  deny     message    = This message contains a virus or other harmful content
($malware_name).
           malware    = *

----------------------

Hope that's enough info. I look forward to any insights you can provide.
Thanks

Ken


--------------------------------------------------------------
Ken Tucker BA MBCS CITP
Senior Engineer - Mail Systems
University Infrastructure Group
Information Services
Cardiff University
[www.cf.ac.uk]
Tel : 029 2087 5015
--------------------------------------------------------------