What's different with the new PDF only spams?

[Leland J. Steinke]

Steve Campbell wrote:
> 
> Now, the rule seem to be insufficient and is letting a lot of the newer 
> ones through. I'm not a RegEx expert, to be sure, so can any one offer a 
> suggestion for a rule to stop this new wave PDF-Only mailings, please?
> 

If you are running SA3.2.2, you can jack up the score for 
GMD_PDF_EMPTY_BODY.  There is also GMD_PDF_ENCRYPTED which is hitting on 
a number of the messages getting past the PDF_ONLY_SPAM rule.  I 
upgraded from 3.1.7 last week, so I do not know when those rules were added.


Leland