a ghost in filetype.rules.conf

[Jeff A. Earickson]

Julian,

   I've been scratching my head on this one for several versions
of MailScanner now.  The head of our athletics dept (who uses a
Mac) will send emails to other coaches, plain text.  Two coaches
who reply (they use Windows) sporadically get their replies rejected
with:

No programs allowed (msg-8402-111.txt)
                         ^^^^^^^^
                         numbers differ

This same rejection message pops up with other users on rare
occasions, but mostly with these two coaches and the Athletic
Director.  I've had our PC staff look at all three machines for
viruses, nothing.

I've put my system into quarantine mode, with
"Quarantine Whole Message = yes", and stared at the result.
There is no attachment.  I've run the entire message thru clam and
sophos, clean. Nothing there but plain text reply to a plain
text message.  My only oddball change in MS relating to text
is my specification of ISO-8859-1 charset instead of ascii.

I've modified my filetype.rules.conf so that I can figure out
which rule causes the rejection (ELF or executable).  Any ideas
or suggestions on this one?  I can provide an example if need
be.  (setup: Sol9, MS 4.26.8, SA 2.63, razor).

Jeff Earickson
Colby College