How are you catching these spam

[Andrews Carl 448]

Found it.
When I pasted the code into the cf, vi commented every line since I
started off with a comment. I missed one of the lines when I uncommented
it.


Thanks,
Carl 

-----Original Message-----
From: Andrews Carl 448 
Sent: Wednesday, May 13, 2009 9:04 AM
To: 'MailScanner discussion'
Subject: RE: How are you catching these spam

Is there a spamassassin plugin I need to enable for this to work? I
placed this in a file in /etc/mail/spamassassin and when I run
spamassassin -D --lint I see that it is loading the file but
'spamassassin -t < spammy_email_message' does not return a spam report
with MIME_PNG_IMAGE_ONLY.

I updated the score line to be "score MIME_PNG_IMAGE_ONLY	4.01"
but that did not get any hits either.

Thanks again!!!
Carl

-----Original Message-----
From: mailscanner-bounces at lists.mailscanner.info
[mailto:mailscanner-bounces at lists.mailscanner.info] On Behalf Of Anthony
Cartmell
Sent: Wednesday, May 13, 2009 6:22 AM
To: MailScanner discussion
Subject: Re: How are you catching these spam

> The two attached png's are samples of what we are getting as spam. The

> message has a random subject and the attachment name apears to be 
> random with nothing in the body of the message.

I've had some success with a borrowed rule, modified to check for PNG
images only (as they all seem to be in this format at the moment):

header          __CTYPE_MULTIPART_MXD           Content-Type =~  
/multipart\/mixed/i
mimeheader      __ANY_TEXT_ATTACH               Content-Type =~  
/text\/\w+/i
mimeheader      __MIME_PNG_ATTACH               Content-Type =~  
/image\/png/i
meta            MIME_PNG_IMAGE_ONLY          (__CTYPE_MULTIPART_MXD &&  
__MIME_PNG_ATTACH && !__ANY_TEXT_ATTACH)
score           MIME_PNG_MAGE_ONLY          4.01
describe        MIME_PNG_IMAGE_ONLY          PNG format image body part

and no text body parts

HTH,

Anthony
--
www.fonant.com - Quality web sites
--
MailScanner mailing list
mailscanner at lists.mailscanner.info
http://lists.mailscanner.info/mailman/listinfo/mailscanner

Before posting, read http://wiki.mailscanner.info/posting

Support MailScanner development - buy the book off the website!