-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Dave . wrote:
> Give them code from Ocr.pm:
>
> ------------------- foreach my $p (
> $pms->{msg}->find_parts("image") ) { my ( $ctype, $boundary,
> $charset, $name ) = Mail::SpamAssassin::Util::parse_content_type(
> $p->get_header('content-type') ); if ( $ctype eq "image/gif" ) {
> open OCR, "|/usr/bin/convert - pnm:-|/usr/bin/gocr -i - >
> /tmp/spamassassin.ocr.$$"; foreach $p ( $p->decode() ) { print OCR
> $p; ------------------- Does this mean the message must have the
> text "image" and/or "image/gif" within the body? Many of the "penny
> stock" spam gifs I get appear as follows:
>
> Should {Fuzzy}OcrPlugin be able to catch this?
>
>
> <IMG alt="" hspace=0
> src="cid:000b01c6bc94$a534f210$9ab30b3b@hniyb.kwf" align=baseline
> border=0></FONT></DIV>
>
First of all, you are using an old version of the plugin, please
upgrade it :)
Secondly, could you send me one or two examples of these mails? Maybe
I can extend the plugin to catch more tricks like this that spammers
try to avoid detection :) The word "image" is supposed to be in the
body, when the content-type of an attachment (image) is specified.
Chris
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
iD8DBQFE23UmJQIKXnJyDxURAsndAJ4tLDmu++8lGLlk5a0KNojlRjDhNACfTU+d
zWnzqypLs/PGqsv0zuMV+Eo=
=LvQN
-----END PGP SIGNATURE-----
