not sure, I think it might be a bug. I initially created the filter using that "image spam" script, and it DID catch the PDF spam... then I changed the [ME_SIZE] value and the filter stopped working.
It was working like a charm for all of a day, now I can't get it to work again.
PDF Spam
-
rockinthesixstring
- Posts: 844
- Joined: Mon Dec 05, 2005 7:51 am
- Location: Canada
-
MailEnable
- Site Admin
- Posts: 4441
- Joined: Tue Jun 25, 2002 3:03 am
- Location: Melbourne, Victoria Australia
I tested the script script and it worked fine for me.
The answer will be to enable script debugging. I am not sure if the setting to do so is in the manual, but details are now available here:
http://www.mailenable.com/mailenable/he ... ipting.asp
Basically, you will notice the the size tokens are substituted with the size of the message, and the "criteriamet" function is used to return the result of the pdf attachment test.
If the PDF is picked up you will see something like this in the filter log file:
The answer will be to enable script debugging. I am not sure if the setting to do so is in the manual, but details are now available here:
http://www.mailenable.com/mailenable/he ... ipting.asp
Basically, you will notice the the size tokens are substituted with the size of the message, and the "criteriamet" function is used to return the result of the pdf attachment test.
If the PDF is picked up you will see something like this in the filter log file:
Code: Select all
MEResultData = "SCRIPT"
Function ME_GetResultData()
ME_GetResultData=MEResultData
End Function
Function CriteriaMet(Value,Condition)
CriteriaMet=(Value<>0)
End Function
Function ME_Execute
FilterResult=0
MEResultData = "SCRIPT"
If CriteriaMet(1,"*.pdf") AND (33378 > 9216) And (33378 < 41000) Then
FilterResult=1
End IfRegards, Andrew
I am sucessfull with a 100% catch rate on the PDF and e-card SPAM, all are DNSBL or no PTR/MX records. I am using ASSP for filtering, it has minimal server performance impact. It is on 2 servers now and processing about 5000 e-mails per day with the average CPU usage of <3%.
I am using the following DNSBL
zen.spamhaus.org
cbl.abuseat.org
bl.spamcop.net
dul.dnsbl.sorbs.net
dnsbl.sorbs.net
list.dsbl.org
ubl.unsubscore.com
My only issue is that my users are lazy and don't take the time to report spam or incorrectly marked spam so that whitelists and otehr areas are updated. So I do have some flase positives being blocked/marked.
I am looking for a script to run on the mailboxes to match criteria in the subject or header so marked mail can be moved to a spam folder in the mailbox.
I am using the following DNSBL
zen.spamhaus.org
cbl.abuseat.org
bl.spamcop.net
dul.dnsbl.sorbs.net
dnsbl.sorbs.net
list.dsbl.org
ubl.unsubscore.com
My only issue is that my users are lazy and don't take the time to report spam or incorrectly marked spam so that whitelists and otehr areas are updated. So I do have some flase positives being blocked/marked.
I am looking for a script to run on the mailboxes to match criteria in the subject or header so marked mail can be moved to a spam folder in the mailbox.
paarlberg,
your doubling your efforts. the zen DNSBL also queries cbl's list, so you do not need to include that. same goes for dnsbl.sorbs, which includes the dul zone and all other sorbs zones. you should remove those two dnsbl's as it will lessen the load on both your mailserver and dnsserver.
take care
your doubling your efforts. the zen DNSBL also queries cbl's list, so you do not need to include that. same goes for dnsbl.sorbs, which includes the dul zone and all other sorbs zones. you should remove those two dnsbl's as it will lessen the load on both your mailserver and dnsserver.
take care
