[Declude.JunkMail] Decludeproc Problems - Resolved

2007-08-07 Thread Todd Richards
Good morning everyone - As you may remember, I had a major problem with the decludeproc service crashing on my server over the weekend. I posted yesterday that, with Linda's help, we figured out the problem. I had a request off-list that I reveal the solution in case others came across the

RE: [Declude.JunkMail] New PDF worm?

2007-08-07 Thread Dave Beckstrom
I installed the filter below and we've had about 50 PDFs that came through today. Does the filter need to be revised or is there some other method I should be looking into using? Thanks! Dave _ From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David Barker Sent:

RE: [Declude.JunkMail] New PDF worm?

2007-08-07 Thread David Barker
From reports today looks like the filter needs to be updated. Can you send me some examples as attachments. David B From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dave Beckstrom Sent: Tuesday, August 07, 2007 3:15 PM To: declude.junkmail@declude.com Subject: RE:

RE: [Declude.JunkMail] New PDF worm?

2007-08-07 Thread Dave Beckstrom
David, I just sent you a bunch of samples. If you can update the filter before you knock off for the day I'd appreciate it. We've probably had 50 of them get through already today. Thanks, Dave _ From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David Barker

RE: [Declude.JunkMail] New PDF worm?

2007-08-07 Thread Todd Richards
David - I sent you about 10 off-list. Todd _ From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David Barker Sent: Tuesday, August 07, 2007 4:03 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] New PDF worm? From reports today looks like the filter

RE: [Declude.JunkMail] New PDF worm?

2007-08-07 Thread David Barker
This is not an easy one I will see what I can get done before I leave today. From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dave Beckstrom Sent: Tuesday, August 07, 2007 5:25 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] New PDF worm? David, I just

RE: [Declude.JunkMail] New PDF worm?

2007-08-07 Thread David Barker
Ok this should hold it over till I can look at it some more tomorrow. David From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David Barker Sent: Tuesday, August 07, 2007 6:45 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] New PDF worm? This is not an

RE: [Declude.JunkMail] New PDF worm?

2007-08-07 Thread Dave Beckstrom
Thanks. I'll give it a try. _ From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David Barker Sent: Tuesday, August 07, 2007 6:23 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] New PDF worm? Ok this should hold it over till I can look at it some

RE: [Declude.JunkMail] New PDF worm?

2007-08-07 Thread Todd Richards
Thanks David. We'll (ok, I'll) give it a whirl! Todd _ From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David Barker Sent: Tuesday, August 07, 2007 6:23 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] New PDF worm? Ok this should hold it over

RE: [Declude.JunkMail] New PDF worm?

2007-08-07 Thread Dave Beckstrom
It didn't work. _ From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Todd Richards Sent: Tuesday, August 07, 2007 6:39 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] New PDF worm? Thanks David. We'll (ok, I'll) give it a whirl! Todd

RE: [Declude.JunkMail] New PDF worm?

2007-08-07 Thread Todd Richards
I received one right away too. It did trigger, but with a weight of 5 it wasn't enough to stop it from making it through. On the flip side, you have to be careful that you don't stop legitimate PDF files. Kind of a tough one... Todd _ From: [EMAIL PROTECTED] [mailto:[EMAIL

Re: [Declude.JunkMail] New PDF worm?

2007-08-07 Thread Darin Cox
I whipped this up mid afternoon, and it's catching them for us. An earlier version this morning didn't catch the entire campaign. - MINWEIGHTTOFAIL 23 SKIPIFWEIGHT 250 REVDNS END ENDSWITH .smarsh.com HEADERS 10 CONTAINS X-Mailer: Microsoft Outlook

RE: [Declude.JunkMail] New PDF worm?

2007-08-07 Thread David Barker
1. Can you send the one that did not trigger? 2. If it did trigger the idea is to give the filter a base value ie. SPAM-PDF filter path\SPAM-PDF.txtx 8 0 From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Todd Richards Sent:

RE: [Declude.JunkMail] New PDF worm?

2007-08-07 Thread David Barker
Did it trigger at all? From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dave Beckstrom Sent: Tuesday, August 07, 2007 9:02 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] New PDF worm? It didn't work. _ From: [EMAIL PROTECTED] [mailto:[EMAIL

RE: [Declude.JunkMail] New PDF worm?

2007-08-07 Thread Dave Beckstrom
No, didn't trigger at all. _ From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David Barker Sent: Tuesday, August 07, 2007 9:33 PM To: declude.junkmail@declude.com Subject: RE: [Declude.JunkMail] New PDF worm? Did it trigger at all? From: [EMAIL PROTECTED]

RE: [Declude.JunkMail] New PDF worm?

2007-08-07 Thread Todd Richards
Thanks Darin. I have adjusted for me, and will see what happens. Todd _ From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darin Cox Sent: Tuesday, August 07, 2007 9:02 PM To: declude.junkmail@declude.com Subject: Re: [Declude.JunkMail] New PDF worm? I whipped this up