different messages

Currently I use the folloowing ACL for virus checking via Sophos

  # Reject virus infested messages.
  deny  message = VIRUS FOUND ($malware_name) - see http://www.abdn.ac.uk/diss/email/gateway.hti
       malware = *

But would like to change it for encrypted files where Sophos replies with

	Error: File was encrypted


Would the following work?


	deny message = $malware_name -  see http://www.abdn.ac.uk/diss/email/gateway.hti
        malware = *
        condition = ${if eq {$substr_0_5:$mailware_name}{Error}{1}{0}}

        deny message = VIRUS FOUND ($malware_name) - see http://www.abdn.ac.uk/diss/email/gateway.hti
        malware = *


John Linn