This is expected behavior. For trickling to start, the ProxySG has to send an HTTP/200 response back to the client. If a virus is detected during data trickling, the proxy can't send another HTTP/200 with the exception page so the data transfer simply stops.

If the exception page is absolutely necessary, trickling needs to be disabled so that the proxy can use it's HTTP/200 response to serve the exception page.