I cannot understand why my embedded image filter does not work at all.

SpamImageThreshold=10
SpamImageColorSensitivity=20
SpamImageMinWidth=200
SpamImageMinHeight=200
SpamImageSamplingPoints=200
MaxGridRecords=200

I have those settings on mi .INI and in near ten million email i didn't find any of this in quarantine. Is there some set i have to activate to let this filter work?

Thank you,
Simone

There is currently an issue with mutliple images in a single email. Roberto is working on it. Below is an entry from my log that shows it detecting some spam. I have my min width & height set to 25.

06/26/06 00:04:32:219 -- (42332) Scanning image for spam:image704.gif
06/26/06 00:04:32:235 -- (42332) Detected spam signature in embedded image
06/26/06 00:04:32:235 -- (42332) Created thread (44484) to add email to quarantine

In would be great for SFI to implement SpamAssassin and leave stuff like this to it since it easily catches all the stock and image spams. I have a filter behind SFI that uses Spamassassin exclusivley and it catches all the image spam and stock market spam SFI misses so my customers never see it, but I do, and it frustrates me since I can't feed it back into SFI.

If a company like MDaemon can write a Spamassassin DLL and get an average of 1-2 emails SA checked per second I'm sure the master programmers at SF could do even better (Just raising the bar Roberto)

Simone,

 Checked my settings in .ini file and don't see anything else that would affect it working. Maybe shoot an email to support to see what we missed.

Regards SA, perl based SA is slow but most Windows spam vendors are creating a DLL and ecapsulating it for speed. I also do not SA check anything that is whitelisted and since its the last test before customers get it I usually average 10-15 SF rejects before 1 email hits the SA filter (using Alt-N's Mdaemon). SFI does a great job for 95% of the mail but that last 5% is possible using spamassin. I guess my customers are spoiled rotten because they take great delight in forwarding to me any new spams that slip thru and I only get 2-3 a month.

LogSat wrote: Starting from build 3.0.1.571 we added the following option in the SpamFilter.ini file: ;To reduce false positives, emails with multiple inline images can bypass the image filter by setting this value to 1 SpamImagePassMultiImage=1 If you set it to 0 all inline images will be scanned for spam. However I do not think (for now - unless we have major requests for this feature ) that we'll add a filter to reject all emails if they simply have multiple inline images, as the number of false positives would be potentially very large (ex. images with embedded signatures/logos/smileys and other symbols - ex. yahoo toolbar symbols) could cause the email to be blocked.

Just to make sure I understand, is the scan in the embedded images for spam looking for keywords I have defined or what?? If the image has "Big Bubbas Stock" in the text of the scanned image do I have to have "Big Bubbas Stock" defined in my keywords?

Still seeing this stuff coming thru and trying to get a handle on it.

Andy