Upgrade to SA 3.1.4 and use a daily sa-update cron job to get the latest rules.
Make sure you're using DCC, Razor, Pyzor, URIBLs, etc. Use the rules from www.rulesemporium.com, and add the ImageIfo plugin from there (http://www.rulesemporium.com/plugins.htm). And train your bayes well. Works for me. Cheers, Phil -- Phil Randal Network Engineer Herefordshire Council Hereford, UK > -----Original Message----- > From: Stephane Bentebba [mailto:[EMAIL PROTECTED] > Sent: 21 August 2006 14:32 > To: [email protected] > Subject: a new kind of spam (with images) > > hi all, > > i am more or less happy with my spamassassin configuration > works good for one year > but i have problem with a new kind of spam which easylly go > throught it : > spam which has poor text, poor token, or none, and a subject > always changing > the only thing which remain the same is the image incoporated in it > it get always very low hit (bellow 3) > subject on the image in the body is either "breaking news > concerning..." > or "we have a runner !" > would it be possible to find a solution ? > add / modify a test to look at first bytes of an attachement and > recognize the image ? > i can send you samples of this spam if you like... (prefer > not to attach > them) > > header extract : > << > X-Spam-FPS_Level: ** > X-Spam-FPS_Checker-Version: SpamAssassin 3.0.4 (2005-06-05) on > empereur.rungis > X-Spam-FPS_Status: No, score=2.5 required=6.0 > tests=DATE_IN_PAST_06_12, > HTML_60_70,HTML_MESSAGE,LONGWORDS autolearn=no version=3.0.4 > > > > > fanx in advance > > > -- > *Stéphane Bentebba > *Technicien de Maintenance > > Tél.: > +33 (0)1.41.73.20.16 > Fax.: > +33 (0)1.41.73.20.08 > > [EMAIL PROTECTED] <mailto:[EMAIL PROTECTED]> > www.fps.fr > <http://www.fps.fr> > <http://www.fps.fr> *FPS France* > Parc d'affaire Silic > 43, rue de la Grosse Pierre > BP 40160 > 94.533 RUNGIS Cedex > > > > > >
