Situation: RootAlyzer lists all ADS streams that are not on a "known" list. Microsoft Fax uses ADS streams to store something.

Experienced: Microsoft Fax uses (unknown char)Xj1phwzh5qcwungrN45kt3kiCe as the name for their streams.

Expected: whitelist if attached to fax files and contents ok.

that funny character is (at least in html language) #21, in html source displayed as ?#21. Don't know if that helps at all.
PacificMorrowind