What's different with the new PDF only spams?

[Rob Sterenborg]

mailscanner-bounces at lists.mailscanner.info wrote:
> Seems like I just stopped seeing those PDF-Only spams using
> the SA rule that was posted here a week or so back.
> 
> Now, the rule seem to be insufficient and is letting a lot of
> the newer ones through. I'm not a RegEx expert, to be sure, so
> can any one offer a suggestion for a rule to stop this new
> wave PDF-Only mailings, please?

If you're usign ClamAV also, consider using the Sanesecurity sigs (and
the automatic update script). They're doing a great job here.


Grts,
Rob