PDA

View Full Version : .gif attachments unable to stop



tortoise
09-21-2006, 11:21 AM
Seems the latest spam rage is attachments carrying __.gif or __.png which sometimes display a image of message and sometimes are blank. I have created several rules in the block list that define any attachment that contains or ends with .gif or .png but the rules seem to have no ipact on these little pests. Is there some trick I am missing?
BTW I am grateful for all the time this application saves, I have been registered user for many years and I can't imagine life without SS.

Michael Tsai
09-21-2006, 11:47 AM
A blocklist rule for "Any Attachment Name Ends With .gif" should work. However, due to the filter order (http://c-command.com/spamsieve/manual-ah/filters) it might be classifying the messages as good before they get to the blocklist. What does the log say (http://c-command.com/spamsieve/manual-ah/open-log) about why the messages were predicted to be good?

Another possibility is that the blocklist rule is disabled (unchecked) due to receiving or training with a good message that would have matched the rule.

Lastly, in my experience SpamSieve has little trouble catching spam messages with image attachments. However, if the corpus is large or old, it would probably help to reset the corpus (http://c-command.com/spamsieve/manual-ah/open-log) and then re-train SpamSieve with the proper mix (http://c-command.com/spamsieve/manual-ah/using-spamsieve-with-yo) of some more recent messages. This would allow you to take full advantages of the newer features in SpamSieve for classifying messages that have images.

tortoise
09-23-2006, 02:52 PM
Thanks for the reply Michael, I may just go ahead and reset the corpus after saving up some spam to use for training purposes. I did that about a year ago and it did as you say seem to really clean things up with better performance and accuracy. Current stats don't look that bad (840 Good, 7457 Spam averaging 17 spam per day, 6 false positives, 110 false negatives 98.6% correct. The Corpus seems in line with 877 good and 2924 Spam but the rules seem a bit overwhelming with 3702 Blocklist and 1809 Whitelist so I suspect that your analysis of a good rule may be overiding before a blocklist can mark it as spam. My first install of SpamSieve ran for about three years before I reset the corpus, but the volume of Spam has increased considerably so I don't mind resetting the corpus and getting a fresh start for improved accuracy. Great application that I recommend to my clients on a regular basis, too bad you only market to Macintosh as my business is only 25% Macintosh and 75% PC.