Hi Scott,
Scott Fisher wrote:
Are there any end users who are using the VAMSOFT IMAGE SPAM AGENT tht
would like to comment on it's effectiveness / processor utilization?
it seems to not use much cpu; its effectiveness is ok. In case you are
unaware it does not ocr the email, it just works on probability - like a
combo filter eg: It returns a value based on its confidence level and I
score accordingly.
Below is how I have it config'ed
[I hold on 10 and delete on 30]
-Nick
EXTERNAL.ORF.IMAGE_80 external 80
"e:\IMail\declude\orf\imgspamagent.exe -check" 1 0
EXTERNAL.ORF.IMAGE_81 external 81
"e:\IMail\declude\orf\imgspamagent.exe -check" 1 0
EXTERNAL.ORF.IMAGE_82 external 82
"e:\IMail\declude\orf\imgspamagent.exe -check" 1 0
EXTERNAL.ORF.IMAGE_83 external 83
"e:\IMail\declude\orf\imgspamagent.exe -check" 1 0
EXTERNAL.ORF.IMAGE_84 external 84
"e:\IMail\declude\orf\imgspamagent.exe -check" 1 0
EXTERNAL.ORF.IMAGE_85 external 85
"e:\IMail\declude\orf\imgspamagent.exe -check" 1 0
EXTERNAL.ORF.IMAGE_86 external 86
"e:\IMail\declude\orf\imgspamagent.exe -check" 1 0
EXTERNAL.ORF.IMAGE_87 external 87
"e:\IMail\declude\orf\imgspamagent.exe -check" 1 0
EXTERNAL.ORF.IMAGE_88 external 88
"e:\IMail\declude\orf\imgspamagent.exe -check" 1 0
EXTERNAL.ORF.IMAGE_89 external 89
"e:\IMail\declude\orf\imgspamagent.exe -check" 1 0
EXTERNAL.ORF.IMAGE_90 external 90
"e:\IMail\declude\orf\imgspamagent.exe -check" 4 0
EXTERNAL.ORF.IMAGE_91 external 91
"e:\IMail\declude\orf\imgspamagent.exe -check" 4 0
EXTERNAL.ORF.IMAGE_92 external 92
"e:\IMail\declude\orf\imgspamagent.exe -check" 4 0
EXTERNAL.ORF.IMAGE_93 external 93
"e:\IMail\declude\orf\imgspamagent.exe -check" 4 0
EXTERNAL.ORF.IMAGE_94 external 94
"e:\IMail\declude\orf\imgspamagent.exe -check" 4 0
EXTERNAL.ORF.IMAGE_95 external 95
"e:\IMail\declude\orf\imgspamagent.exe -check" 5 0
EXTERNAL.ORF.IMAGE_96 external 96
"e:\IMail\declude\orf\imgspamagent.exe -check" 5 0
EXTERNAL.ORF.IMAGE_97 external 97
"e:\IMail\declude\orf\imgspamagent.exe -check" 5 0
EXTERNAL.ORF.IMAGE_98 external 98
"e:\IMail\declude\orf\imgspamagent.exe -check" 6 0
EXTERNAL.ORF.IMAGE_99 external 99
"e:\IMail\declude\orf\imgspamagent.exe -check" 7 0
EXTERNAL.ORF.IMAGE_100 external 100
"e:\IMail\declude\orf\imgspamagent.exe -check" 8 0
----- Original Message -----
*From:* David Barker <mailto:[EMAIL PROTECTED]>
*To:* declude.junkmail@declude.com
<mailto:declude.junkmail@declude.com>
*Sent:* Wednesday, February 21, 2007 12:08 PM
*Subject:* RE: [Declude.JunkMail] Image spam
*_Declude and Image based spam - 4 methods
_1. COMMTOUCH*
Commtouch Recurrent Pattern Detection contains an intrinsic
mechanism to exact-match recurrent patterns across similar but
not-identical messages. However in the case of images, the minute
the spammer makes even the smallest changes to an image, the
image-encoded data appears completely different. Commtouch
identified this trend in the earliest days of image-based spam,
and made the necessary enhancements to its detection engine in
order to defend against this new threat with a sophisticated
protection shield. Commtouch invested significant resources into
developing a method for decoding the images and then sampling them
using the proven RPD approach. The result is a significantly
improved spam detection rate, while maintaining the same low
false-positive rate.
*2. CLAMWIN*
Using ClamAV as a virus scanner with Declude you can download the
MSRBL-Images.hdb file which has additional signatures (MD5 sigs)
which contains signatures created from images contained within
spam emails. http://www.msrbl.com/site/msrblimagesdownload
*3. FILTER-CID*
Identifies emails which contains images increasing the weight
suffeciently on spam messages to reach the spam threshold.
#EXCEPTIONS
BODY END NOTCONTAINS cid:
BODY END NOTCONTAINS Content-Type: image/
#IMAGES
BODY 3 CONTAINS src=3D"cid:
BODY 3 CONTAINS src="cid:
BODY 3 CONTAINS src='cid:
BODY 3 CONTAINS img src="cid:
BODY 3 CONTAINS img src=3Dcid:
BODY 3 CONTAINS /cid:
#IMAGE TYPES
BODY 2 CONTAINS Content-Type: image/gif;
BODY 2 CONTAINS Content-Type: image/jpeg;
*4. VAMSOFT IMAGE SPAM AGENT*
This tool is an External Agent for ORF 2.1 and newer versions that
improves ORF by image spam detection capabilities, but can be used
by Declude. http://www.vamsoft.com/vsimagespam/vsimagespam.zip
VSIMAGE external nonzero
"[path]\Declude\VSIMAGE\imgspamagent.exe -check" 4 0
David Barker
Director of Product Management
Your Email security is our business
978.499.2933 office
978.988.1311 fax
[EMAIL PROTECTED]
------------------------------------------------------------------------
*From:* [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] *On
Behalf Of *Kelly Scotto
*Sent:* Wednesday, February 21, 2007 11:47 AM
*To:* declude.junkmail@declude.com
*Subject:* [Declude.JunkMail] Image spam
Has there been a declude filter created for blocking or
identifying image spam? If so can somebody post it for me to try.
Thank You,
Kelly
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
