<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=us-ascii">
<META content="MSHTML 6.00.5346.5" name=GENERATOR></HEAD>
<BODY>
<DIV dir=ltr align=left><SPAN class=732455614-10052006><FONT face=Arial
color=#0000ff size=2>Tobias,</FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN class=732455614-10052006><FONT face=Arial
color=#0000ff size=2></FONT></SPAN> </DIV>
<DIV dir=ltr align=left><SPAN class=732455614-10052006><FONT face=Arial
color=#0000ff size=2>The Sare stock rules set has some specific rules for
detecting inline gif images.</FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN class=732455614-10052006><FONT face=Arial
color=#0000ff size=2>See <A
href="http://www.rulesemporium.com">http://www.rulesemporium.com</A>.</FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN class=732455614-10052006><FONT face=Arial
color=#0000ff size=2>Also if you use sa-update, it includes some new rules for
this in 80_additional.cf.</FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN class=732455614-10052006><FONT face=Arial
color=#0000ff size=2></FONT></SPAN> </DIV>
<DIV dir=ltr align=left><SPAN class=732455614-10052006><FONT face=Arial
color=#0000ff size=2>Adri.</FONT></SPAN></DIV><BR>
<BLOCKQUOTE dir=ltr
style="PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #0000ff 2px solid; MARGIN-RIGHT: 0px">
<DIV class=OutlookMessageHeader lang=en-us dir=ltr align=left>
<HR tabIndex=-1>
<FONT face=Tahoma size=2><B>From:</B>
mailscanner-bounces@lists.mailscanner.info
[mailto:mailscanner-bounces@lists.mailscanner.info] <B>On Behalf Of </B>Tobias
Axelsson<BR><B>Sent:</B> woensdag 10 mei 2006 16:50<BR><B>To:</B> MailScanner
discussion<BR><B>Subject:</B> Spam with the bodytext in a
image<BR></FONT><BR></DIV>
<DIV></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><SPAN class=567034214-10052006><FONT face=Arial
size=2>Hi</FONT></SPAN></DIV>
<DIV><SPAN class=567034214-10052006><FONT face=Arial
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=567034214-10052006><FONT face=Arial size=2>We have some
problem with spam that sends a mail only containing a gif-image with the text
in.</FONT></SPAN></DIV>
<DIV><SPAN class=567034214-10052006></SPAN><SPAN
class=567034214-10052006><FONT face=Arial size=2>
<DIV><SPAN class=567034214-10052006><FONT face=Arial size=2>Offcourse they
change the filename everytime.</FONT></SPAN></DIV>
<DIV><SPAN class=567034214-10052006></SPAN> </DIV></FONT></SPAN></DIV>
<DIV><SPAN class=567034214-10052006><FONT face=Arial size=2>I'm not sure if
it's ok to attach files to this list, so I don't :)</FONT></SPAN></DIV>
<DIV><SPAN class=567034214-10052006><FONT face=Arial
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=567034214-10052006><FONT face=Arial size=2>One solution could
be a md5sum-blacklist on attachment, becourse the md5sum does'nt change if you
change the filename...</FONT></SPAN></DIV>
<DIV><SPAN class=567034214-10052006><FONT face=Arial
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=567034214-10052006><FONT face=Arial size=2>Is there current a
function that I can use for this or is this maybe a future reliase feature to
add?</FONT></SPAN></DIV>
<DIV><SPAN class=567034214-10052006><FONT face=Arial
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=567034214-10052006><FONT face=Arial size=2>Thanks for a great
bundled software</FONT></SPAN></DIV>
<DIV><SPAN class=567034214-10052006><FONT face=Arial
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=567034214-10052006><FONT face=Arial
size=2>/Tobias</FONT></SPAN></DIV>
<DIV><SPAN class=567034214-10052006><FONT face=Arial size=2>Vaxjo
university</FONT></SPAN></DIV></BLOCKQUOTE></BODY></HTML>