do you know ImageCerberusPLG4 ?

[knarou]

Hello everybody,

do you know the rules ImageCerberusPLG4 in mailscanner spamassasin ?
Beacause sometime, when local user send mail , it go directely in spam with this rules.

Spam Report:
Score Matching Rule Description
-1.00 ALL_TRUSTED
-1.90 BAYES_00
0.00 HTML_MESSAGE
4.00 ImageCerberusPLG4
1.90 MISSING_MIMEOLE
1.51 SUBJ_ALL_CAPS
2.17 TVD_RCVD_SINGLE
0.00 URIBL_BLOCKED
1.51 URIBL_RHS_DOB

Thanks in advance.

Have a nice day
K

[shawniverson]

Is there an image attached to the email? Perhaps a picture in the signature line?

I have had the rule fire off on rare occasions from such pictures.

[ssheikh]

Same problem here. I have this fire off 90% of the time with a score of 4 with one company that we regularly exchange e-mails with. It causes a fair amount of e-mails from them to get flagged as possible spam.

They have Twitter, LinkedIn, YouTube, etc icons as part of their standardized signature. Amongst those icons, there also what appears to be a 75 x 75 pixel just blank off-white tile in the form of a few byte jpeg file. The lowest common denominator I have found is that jpeg file triggers ImageCerberusPLG4 with a score of 4.

I have looked through several hundred actual spam messages and none of them were trapped as a result of ImageCerberusPLG4. Yet on a daily basis I get more than 15 messages that get falsely flagged as possible spam because of ImageCerberusPLG4. And the end-users routinely have problems in releasing those messages (which is a different problem I am troubleshooting).

Looking for a way to turn it off and keep it off through upgrades.

Thanks,

Shahid

[shawniverson]

You can add a spamassassin rule to local.cf to override this score...

[Matthew]

Hi All
I need to do some massaging of the Spam assassin scores to save ourselves time
I have tried editing the local.cf and this is not appearing to work
Therefore I am the issue

Is there any more info on how this Spam assassin is implemented that I can work with?
For example the rules go in the shortcircuit zone or before this etc

One reason I am having is this fc file is effectively empty and all rules are hashed out
The only rule not hashed is the if / end if for the shortcircuit

thanks in advance

[shawniverson]

Correct, in the cast of ImageCerberusPLG4, you would add the following to local.cf:

Code: Select all

score     ImageCerberusPLG4     1.0  1.0  1.0  1.0

I changed it to 1 from 4 in this example.

[pdwalker]

You can add a spamassassin rule to local.cf to override this score...

being pendantic; the file is in:

/etc/mail/spamassassin/local.cf

Question: do we need to restart spamassassin after changing the rules?

[darky83]

Not sure, don't think it is needed.

spamassassin is invoked by mailscanner at each mail, so guessing that the config is re-read everytime.
But might be that the config is cached somewhere, so if it is not working just reload the MailScanner service.

[toddh]

Realize this is an old thread but we had this happen today, email block by ImageCerberusPLG4.

It was a .gif that was only a small white rectangle.

Added the exception to local.cf and all is good.

Thanks!


-