Image spam is rather difficult to deal with. FuzzyOcr has helped me do so.
Of course, running an OCR scanner on images contained in messages will slow
down the spam scanning process (considerably in some cases), but for me this is not a problem, just
be aware of it. I document my installation of FuzzyOcr here.
I will assume you have at least testing and stable sources listed
in /etc/apt/sources.list, and 'stable' has top priority in
and you are able to compile programs from source (but of course there is
no reason you could not install this stuff on an Etch or Sid system).
You need to be at SpamAssassin version 3.1.1 or greater to use these plugins.
Consider installing SpamAssassin from
if you are trying to keep your system 'stable'. You can possibly install
SpamAssassin from 'testing' without upgrading to the testing versions
of libc6 or Perl or the Kernel by
using the form 'apt-get install spamassassin/testing'. Using this form should
install dependencies from 'stable'. Simulate it first with 'apt-get -s install [...]'.
In order to prevent accidental upgrades when running 'apt-get upgrade'
you might also consider putting the package on hold if you use this method:
echo "spamassassin hold" | dpkg --set-selections
One of the programs we need is not available in the stable release, so we will install from testing. First test that installing libimage-exiftool-perl will not install libc6 or related programs:
If libimage-exiftool-perl is the only thing that will be installed, then install it. If it is not, and you are trying to keep your system stable, then contact me before you continue:
If your version is less than 6.36-1, patch ExifTool:
You should not have both giflib-bin and libungif installed. Simulate removing giflib-bin:
If it's not installed, then you can move on. If it's the only thing that will be removed, then remove it:
Download, extract, patch, compile and install libungif:
' AnENTlON ALL DAY TRADERS AND INVESTORS 'Run another test. The result should be roughly the same, but this time you should not get error messages from giftopnm:
If you installed SpamAssassin using apt-get, the /Plugin directory should be /usr/share/perl5/Mail/SpamAssassin/Plugin. If yours is different, you will need to modify the commands below.
and insert (at the bottom):
#loadplugin FuzzyOcr FuzzyOcr.pm
If (and only if) you are using a version of SpamAssassin less than 3.1.4, uncomment this line and set the value to 1.0:
Set focr_base_score to 2 (this is my personal choice):
Only while we test, set focr_autodisable_score to 50:
Save and exit the file, then we test. Start by linting spamassassin:
Once you have resolved any (serious) lint errors, we do some more testing. This assumes you are still in the /usr/local/src/fuzzyocr-2.3b directory:
19 FUZZY_OCR BODY: Mail contains an image with common spam text inside Words found: "alert" in 4 lines "charts" in 1 lines "symbol" in 1 lines "alert" in 4 lines "stock" in 2 lines "company" in 3 lines "trade" in 1 lines "xanax" in 1 lines "meridia" in 1 lines "growth" in 1 lines (19 word occurrences found)If you did not get something similar, check the log for the last error message (if any).
For example, on a low powered machine you may have to increase focr_timeout in /etc/spamassassin/FuzzyOcr.cf:
Ideally, FuzzyOcr.log will not exist. Continue on to the next test:
1.5 FUZZY_OCR_WRONG_CTYPE BODY: Mail contains an image with wrong content-type set Image has format "GIF" but content-type is "image/jpeg" 2.5 FUZZY_OCR_CORRUPT_IMG BODY: Mail contains a corrupted image Corrupt image: GIF-LIB error: Image is defective, decoding aborted. 10 FUZZY_OCR BODY: Mail contains an image with common spam text inside Words found: "alert" in 1 lines "alert" in 1 lines "stock" in 2 lines "investor" in 1 lines "company" in 1 lines "trade" in 1 lines "target" in 1 lines "service" in 1 lines "recommendation" in 1 lines (10 word occurrences found)Continue on to the next test (make sure your focr_autodisable_score is 50):
4.0 FUZZY_OCR BODY: Mail contains an image with common spam text inside Words found: "viagra" in 2 lines "cialis" in 1 lines "levitra" in 1 lines (4 word occurrences found)Continue on to the next test
(if this one fails, read http://marc.theaimsgroup.com/?l=spamassassin-users&m=115664281009909):
28 FUZZY_OCR BODY: Mail contains an image with common spam text inside Words found: "alert" in 2 lines "news" in 2 lines "symbol" in 1 lines "alert" in 2 lines "stock" in 1 lines "investor" in 3 lines "company" in 2 lines "buy" in 1 lines "price" in 2 lines "trade" in 2 lines "target" in 2 lines "service" in 2 lines "recommendation" in 1 lines "levitra" in 1 lines "software" in 2 lines (26 word occurrences found)Edit FuzzyOcr.cf and set focr_autodisable_score score back to a more reasonable level:
I set the focr_autodisable_score to the same value as my $sa_kill_level_deflt in amavisd.conf:
Reload amavisd-new (or spamd if you are using that):
And keep an eye on the mail.log for a while:
If you upgrade to SpamAssassin 3.1.4 or newer from an older 3.1.x version, remember to set focr_pre314 to 0.0
Now we will install another plugin. This one is from SARE
Once again, navigate to your Plugin directory and grab the plugin:
Also get the configuration file:
and insert (at the bottom):
Edit imageinfo.cf and lower any scores that are 3.0 or more to half their value. This is to help prevent false positives:
Save and exit the file, and of course, lint spamassassin:
and reload amavisd-new (or spamd if you are using that):