Write this…

Install-TransportAgent -Name “Vamsoft Test Agent” -AssemblyPath “E:\ORF\testagent\TestAgent.dll” -TransportAgentFactory=”Vamsoft.ORF.TestAgent.TestAgentFactory”

…instead of this…

Install-TransportAgent -Name “Vamsoft Test Agent” -AssemblyPath “E:\ORF\testagent\TestAgent.dll” -TransportAgentFactory “Vamsoft.ORF.TestAgent.TestAgentFactory”

…and lament on why PowerShell is giving you a prompt instead of an error message or something. Experiment with replacing -Name with -Identity. Boot your other virtual server where once this stuff worked and check why it worked there. Watch your computer running out of free memory with two virtual servers concurrently running. Shut down the other virtual server and wait while all running apps are mapped back to the live memory from the system swap. Get upset and pause both virtual machines as a desperate attempt. Realize that you’re just making the situation worse. Get a coffee, start with fresh mind. Look clueless. Then, finally, find the needless equals sign :)

Did you know that you can query the ORF statistics counters from the Windows PowerShell? This is how it works for the cumulative On Arrival “Tested Emails” counter:

$ORF = New-Object -com “orfeesvc.EnterpriseService”
$cumulative = “”

$sincestartup = “”

$ORF.GetStatisticsEx([ref] $cumulative, [ref] $sincestartup)

$xmldoc = New-Object -com “MSXML.DomDocument”

$xmldoc.loadXML($cumulative)

$node = $xmldoc.selectSingleNode(“/statistics/onarrival/tested”)

$oatested = $node.nodeTypedValue

That’s because PowerShell can invoke COM objects and what ORF returns via the GetStatisticsEx() method is really just XML that can be loaded into the COM-based MSXML parser, and so on…

The title says it all, we just have released an update to the PDF Spam Agent.

There entire PDF spam recognizer engine was rewritten to deal with the new types of PDF spam and it detects most of them pretty well. We did not add rules for some less widespread/older PDF spam types that are unexpected to be repeated in the future, but still there are 8 new types of PDF spam that are caught by the agent.

We have also changed the source code license to LGPL 3, so now the gates are open for admins with programming skills and programmers with admin skills and programmers without admin skills and just for everyone to improve the agent. I think the code is quite well documented and reasonably organized considering the limited time we had, but if you have any questions, feel free to ask.

The second wave of the PDF spam phenomenon is here and it quickly rendered the PDF Spam Agent practically useless, due to its design that focused on the first outbreak only. In the past two weeks, we received many PDF spam reports (thank you!) and analyzed more than 100 of these by hand.

Unlike the first wave, the second one utilizes various software and technology for generating the PDF payload. It appears that spammer groups are experimenting with a number of tools, often the same stock pump spam was generated with 2 or 3 different software, from text2pdf to OpenOffice. Based on the email properties, I broke the samples into 11 groups that show distinguishing properties. The good news is that these properties are also different from that of legitimate PDFs, so technically we can adjust the engine to recognize them. It will take time, though and also we have a different focus now (Exchange 2007), but we are working on the new PDF Spam Agent version.