image spam

Sat May 13 20:43:27 IST 2006

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

It matches this:

<!doctype html publix "....." />
<html>
<head>
<meta ..... content = "....." name = "GENERATOR">
<style .....>
</style>
</head>
<body bgColor = .......>
</div>
<font face = arial size = 2>
<img alt = "...." hspace = 0 src = "cid:...... at ....." align = baseline 
border 0>
</font>
</dev>
</body>
</html>

which shouldn't match anything that it isn't intended to. It's pretty 
specific on the sort of image it matches shouldn't turn up in place it 
wasn't expected.
So the rule probably works okay.

Rune Gundersen wrote:
> m/^\s*?\<!doctype\s+?html\s+?public\s+?"[^"]+?"\s*?\>\s*?\<html\>\s*?
> \<head\>\s*?\<meta\s+?[^>]*?content\s*?=\s*?(["'])[^\1]*?\1\s*?
> name\s*?=\s*?["']?GENERATOR["']?\s*?\>\s*?\
> <style[^>]*?\>.*?\<\/style\s*?\>\s*?\<\/head\s*?\>\s*?\<body\s+?
> bgColor\s*?=\s*?\S{7,7}\s*?\>\s*?\<div[^>]*?\>.*?\<font\s+?face\s*?
> =\s*?arial\s+?size\s*?=\s*?2\*?\>[^<]*?\<img\s+?alt\s*?=\s*?(["'])
> \2\s+?hspace\s*?=\s*?0\s+?src\s*?=\s*?(["'])cid\:[^@]{30,30}@
> [^\3]*?\3\s+?align\s*?=\s*?baseline\s+?border\s*?=\s*?0\>\s*?\<\/font\>
> \s*?\<\/div\>\s*?\<\/body\>\s*?\<\/html\>\s*?$/
> score image_spam 10
> describe image_spam  stopping thoose image spams
>
> Maybe someone has some input on this ?
>
> // Rune Gundersen

- -- 
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store
Professional Support Services at www.MailScanner.biz
MailScanner thanks transtec Computers for their support

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

-----BEGIN PGP SIGNATURE-----
Version: PGP Desktop 9.0.6 (Build 6060)

iQA/AwUBRGY24RH2WUcUFbZUEQIP4wCfXVmGELz8+n85NNiyGV79Wxs4dI8AnAgQ
PqfwogYEut/qdREqJrGHJKNG
=2MMk
-----END PGP SIGNATURE-----

-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.
MailScanner thanks transtec Computers for their support.