The access log field, x-virus-id, reports a specific virus id such a EICAR-Test-File but x-exception-id does not include not virus_detected.
The access log values are as follows:
The ProxySG report the exception as expected if your external_services configuration includes a check mark next to the option, use-vendor-virus-page.
You can verify this in your Proxy's Sysinfo file. Search it with the strin: BEGIN external_services.
!- BEGIN external_services
!- END external_services
No action required.
Accesslog data seems to be indicating pass through the virus data.
But your customer will be receive vendor of exception page when AV system detect virus.