Re: a new kind of spam (with images)

[Stephane Bentebba]

fanku, i do use DCC, razor and pyzor do use also uribl with qmail-scanner (i think) there is a cron wich sa-learn all ham and spam (more than 2000 spams inside) but i could gain in using the rest you adviced to me so i will have a serious look at it - as soon as i can especially the sa-update function the plugin imageinfo unfortunatelly don't try to recognise the image so it won't help me on this problem fanx great phil Randal, Phil a écrit : Upgrade to SA 3.1.4 and use a daily sa-update cron job to get the latest rules. Make sure you're using DCC, Razor, Pyzor, URIBLs, etc. Use the rules from www.rulesemporium.com, and add the ImageIfo plugin from there (http://www.rulesemporium.com/plugins.htm). And train your bayes well. Works for me. Cheers, Phil -- Phil Randal Network Engineer Herefordshire Council Hereford, UK -----Original Message----- From: Stephane Bentebba [mailto:[EMAIL PROTECTED]] Sent: 21 August 2006 14:32 To: users@spamassassin.apache.org Subject: a new kind of spam (with images) hi all, i am more or less happy with my spamassassin configuration works good for one year but i have problem with a new kind of spam which easylly go throught it : spam which has poor text, poor token, or none, and a subject always changing the only thing which remain the same is the image incoporated in it it get always very low hit (bellow 3) subject on the image in the body is either "breaking news concerning..." or "we have a runner !" would it be possible to find a solution ? add / modify a test to look at first bytes of an attachement and recognize the image ? i can send you samples of this spam if you like... (prefer not to attach them) header extract : << X-Spam-FPS_Level: ** X-Spam-FPS_Checker-Version: SpamAssassin 3.0.4 (2005-06-05) on empereur.rungis X-Spam-FPS_Status: No, score=2.5 required=6.0 tests=DATE_IN_PAST_06_12, HTML_60_70,HTML_MESSAGE,LONGWORDS autolearn=no version=3.0.4 fanx in advance -- *Stéphane Bentebba *Technicien de Maintenance Tél.: +33 (0)1.41.73.20.16 Fax.: +33 (0)1.41.73.20.08 [EMAIL PROTECTED] <mailto:[EMAIL PROTECTED]> www.fps.fr <http://www.fps.fr> <http://www.fps.fr> *FPS France* Parc d'affaire Silic 43, rue de la Grosse Pierre BP 40160 94.533 RUNGIS Cedex -- Stéphane Bentebba Technicien de Maintenance Tél.:  +33 (0)1.41.73.20.16 Fax.:  +33 (0)1.41.73.20.08 [EMAIL PROTECTED] www.fps.fr FPS France Parc d'affaire Silic 43, rue de la Grosse Pierre BP 40160 94.533 RUNGIS Cedex