--- Comment #7 from Graeme Fowler <graeme@???> 2011-12-05 13:38:55 ---
(In reply to comment #6) > Exim 4.69 was replaced by Exim 4.70 in November 2009. We're now on Exim 4.77.
> All of the ClamAV integration has been completely replaced in the meantime with
> new code.
But this *is most likely not* to do with ClamAV, nor any other ACL time hooks.
Yes, the infected message got through the filtering but once on the queue it's
the queue runner which exhibits a problem, and that literally picks up the
message and passes it via whichever transport is due to process it.
That said, we don't have that strace output yet, so hard to see what's going on