| > > this RE apparently just meatches a
| > > MIME/BASE64 encoded W32 ELF header):
| > >
| > > 	^TV[nopqr][A-Z]...[AB]..A.A....*AAAA...*AAAA
| > 
| > Some quick poking and I couldn't find any reference to this.  What's
| > your source?
|  
|  I have no idea. That doesn't read like a postfix configuration line anyway.

  I've got 

/^TVqQAAMA/             REJECT Your mail contains windows executable, this is pr
obably a virus. 

  in my filter rules for ages, and it works pretty well to catch
that crap. I have seen varations of that (like the quoted one above
or with a longer trailer to exactly match W32 headers only).

	mjl