Mails misclassified from vBulletin Forum Software

[Joerg Rohrer]

On 10-09-2014 19:03, Noel Jones wrote:
> On 9/10/2014 11:47 AM, Joerg Rohrer wrote:
>> Hi
>> 
>> On 10-09-2014 15:59, Ralf Hildebrandt wrote:
>>> * Joerg Rohrer <joerg at joergi.ch>:
>>> 
>>> "file" is to blame:
>>> 
>>>> Sep 10 15:21:00 alpha amavis[8825]: (08825-01) result line from
>>>> file(1): p001: Python script, UTF-8 Unicode text executable\n
>>>> Sep 10 15:21:00 alpha amavis[8825]: (08825-01) lookup_re("Python
>>>> script, UTF-8 Unicode text executable") matches key
>>>> "(?^i:\bexecutable\b)", result="exe"
>>>> Sep 10 15:21:00 alpha amavis[8825]: (08825-01) lookup
>>>> [map_full_type_to_short_type] => true,  "Python script, UTF-8
>>>> Unicode text executable" matches, result="exe",
>>>> matching_key="(?^i:\134bexecutable\134b)"
>> 
>> Thanks for all of your answers. It makes absolute sense that file is
>> the culprit.
>> But why this happen all of a sudden? There were no obvious changes
>> one the system (file, amavis, postfix).
> 
> Perhaps the email contents changed.  Do you have one in quarantine
> you can examine?  Maybe run file on it by hand?
> 
> Regardless, check to see if an update for file(1) is available.
> 
> 
>   -- Noel Jones

Thanks Noel for the hint. Indeed there were a change in the header. see 
below. don't know if that could be the reason.
--------
bad mail:

Content-Type: text/plain; charset="ISO-8859-1"
Date: Fri, 05 Sep 2014 00:10:24 +0200

good mail:

Content-Type: text/plain; charset="UTF-8"
Date: Mon, 08 Sep 2014 00:10:22 +020
--------

Am i right sending side has change this?

Thanks
Jörg