I really do not know if the problem is rspamd or exim since by default exim tries to connect using sophie (sophos) antivirus:
malware acl condition: sophie /var/run/sophie : unable to connect to UNIX socket (/var/run/sophie): No such file or directory
in the exim configure i set this:
spamd_address = x.x.x.x 11333 variant=rspamd
deny malware = */defer_ok
message = This message contains a virus ($malware_name).
any ideas?