Spam Filter ISP Support Forum

  New Posts New Posts RSS Feed - Detected spam signature in embedded image
  FAQ FAQ  Forum Search   Register Register  Login Login

Detected spam signature in embedded image

 Post Reply Post Reply
Author
JamesW View Drop Down
Newbie
Newbie


Joined: 23 February 2011
Location: DFW
Status: Offline
Points: 2
Post Options Post Options   Thanks (0) Thanks(0)   Quote JamesW Quote  Post ReplyReply Direct Link To This Post Topic: Detected spam signature in embedded image
    Posted: 23 February 2011 at 10:00am
One of my VP's had an email from his wife spam filtered. When I looked into the matter, it turns out that the embedded image was being detected as spam. I received error 557: Detected spam signature in embedded image

I tried saving the image and sending it with a different name, changing the format from png to jpg, and tried editing the image to see if that made a difference. It's not a large image and is not anything even remotely "controversial"

I really would like to know what caused this to happen and how I can prevent it from happening in the future. If need be, I can send the image.

Thanks

- James
Back to Top
LogSat View Drop Down
Admin Group
Admin Group
Avatar

Joined: 25 January 2005
Location: United States
Status: Offline
Points: 4068
Post Options Post Options   Thanks (0) Thanks(0)   Quote LogSat Quote  Post ReplyReply Direct Link To This Post Posted: 23 February 2011 at 12:03pm
James,

The image filter performs an statistical analysis on the image to see if it "looks like" other images that are present in other spam emails. Statistics unfortunately is not always 100% accurate, so this filter, like some other, may occasionally stop valid images.

You can disable it completely, or can try to lower its threshold to be less sensitive. The GUI setting for is the "Image filter threshold", which you can find by seeing this screenshot:
http://www.logsat.com/sfi-spam-filter-screenshots/sfi-filtering-options.asp

In addition, the following settings can be changed in the SpamFilter.ini file to further tweak this filter (you do not need to restart SpamFilter after making the changes, they will be re-imported automatically within 60 seconds).
 
The ones that can be tweaked most safely to adjust to the customers signatures are the ones in bold below that tell SpamFilter which image sizes to ignore. Any image that is smaller than the one indicated below will not be scanned. You could try increasing those values to 400-500 to lower the number of false positives as well.

;Image filter threshold. Higher values indicate a more aggressive filter. 0 disables the filter. Min=0, Max=15
SpamImageThreshold=10
 
;Image filter color sensitivity. Used internally to detect color shades
SpamImageColorSensitivity=20
 
;Images embedded in email's html having a width smaller than this will not be scanned. Useful to bypass signatures and logos
SpamImageMinWidth=300
 
;Images embedded in email's html having a height smaller than this will not be scanned. Useful to bypass signatures and logos
SpamImageMinHeight=300

;Determines the number of points that will be scanned in a image to process it for spam
SpamImageSamplingPoints=200
Roberto Franceschetti

LogSat Software

Spam Filter ISP
Back to Top
JamesW View Drop Down
Newbie
Newbie


Joined: 23 February 2011
Location: DFW
Status: Offline
Points: 2
Post Options Post Options   Thanks (0) Thanks(0)   Quote JamesW Quote  Post ReplyReply Direct Link To This Post Posted: 23 February 2011 at 12:29pm
I went ahead and adjusted the settings in spamfilter.ini, and did additional testing. I am happy to report that he can now send that email without it being filtered.

I am going to keep an eye on things to make sure we do not get too much additional spam from the setting change, but I am not anticipating it rising enough to warrant a change back

Thanks for the help
Back to Top
yapadu View Drop Down
Senior Member
Senior Member


Joined: 12 May 2005
Status: Offline
Points: 272
Post Options Post Options   Thanks (0) Thanks(0)   Quote yapadu Quote  Post ReplyReply Direct Link To This Post Posted: 23 February 2011 at 7:53pm
Originally posted by JamesW JamesW wrote:

how I can prevent it from happening in the future. If need be, I can send the image.


It is always a problem when the big guys have an issue, they have the biggest bite.  I would suggest you also whitelist his wife's email address.
--------------------------------------------------------------
I am a user of SF, not an employee. Use any advice offered at your own risk.
Back to Top
 Post Reply Post Reply
  Share Topic   

Forum Jump Forum Permissions View Drop Down



This page was generated in 0.267 seconds.