Page 1 of 1

do you know ImageCerberusPLG4 ?

Posted: 06 Oct 2014 10:25
by knarou
Hello everybody,

do you know the rules ImageCerberusPLG4 in mailscanner spamassasin ?
Beacause sometime, when local user send mail , it go directely in spam with this rules.

Spam Report:
Score Matching Rule Description
-1.00 ALL_TRUSTED
-1.90 BAYES_00
0.00 HTML_MESSAGE
4.00 ImageCerberusPLG4
1.90 MISSING_MIMEOLE
1.51 SUBJ_ALL_CAPS
2.17 TVD_RCVD_SINGLE
0.00 URIBL_BLOCKED
1.51 URIBL_RHS_DOB

Thanks in advance.

Have a nice day
K

Re: do you know ImageCerberusPLG4 ?

Posted: 06 Oct 2014 13:53
by shawniverson
Is there an image attached to the email? Perhaps a picture in the signature line?

I have had the rule fire off on rare occasions from such pictures.

Re: do you know ImageCerberusPLG4 ?

Posted: 05 Nov 2014 07:28
by ssheikh
Same problem here. I have this fire off 90% of the time with a score of 4 with one company that we regularly exchange e-mails with. It causes a fair amount of e-mails from them to get flagged as possible spam.

They have Twitter, LinkedIn, YouTube, etc icons as part of their standardized signature. Amongst those icons, there also what appears to be a 75 x 75 pixel just blank off-white tile in the form of a few byte jpeg file. The lowest common denominator I have found is that jpeg file triggers ImageCerberusPLG4 with a score of 4.

I have looked through several hundred actual spam messages and none of them were trapped as a result of ImageCerberusPLG4. Yet on a daily basis I get more than 15 messages that get falsely flagged as possible spam because of ImageCerberusPLG4. And the end-users routinely have problems in releasing those messages (which is a different problem I am troubleshooting).

Looking for a way to turn it off and keep it off through upgrades.

Thanks,

Shahid

Re: do you know ImageCerberusPLG4 ?

Posted: 08 Nov 2014 18:52
by shawniverson
You can add a spamassassin rule to local.cf to override this score...

Re: do you know ImageCerberusPLG4 ?

Posted: 15 Dec 2014 06:51
by Matthew
Hi All
I need to do some massaging of the Spam assassin scores to save ourselves time
I have tried editing the local.cf and this is not appearing to work
Therefore I am the issue

Is there any more info on how this Spam assassin is implemented that I can work with?
For example the rules go in the shortcircuit zone or before this etc

One reason I am having is this fc file is effectively empty and all rules are hashed out
The only rule not hashed is the if / end if for the shortcircuit

thanks in advance

Re: do you know ImageCerberusPLG4 ?

Posted: 17 Dec 2014 23:59
by shawniverson
Correct, in the cast of ImageCerberusPLG4, you would add the following to local.cf:

Code: Select all

score     ImageCerberusPLG4     1.0  1.0  1.0  1.0
I changed it to 1 from 4 in this example.

customizing spamassassin scores: local.cf

Posted: 02 Apr 2015 04:55
by pdwalker
shawniverson wrote:You can add a spamassassin rule to local.cf to override this score...
being pendantic; the file is in:
/etc/mail/spamassassin/local.cf
Question: do we need to restart spamassassin after changing the rules?

Re: do you know ImageCerberusPLG4 ?

Posted: 02 Apr 2015 19:02
by darky83
Not sure, don't think it is needed.

spamassassin is invoked by mailscanner at each mail, so guessing that the config is re-read everytime.
But might be that the config is cached somewhere, so if it is not working just reload the MailScanner service.

Re: do you know ImageCerberusPLG4 ?

Posted: 28 Apr 2016 18:25
by toddh
Realize this is an old thread but we had this happen today, email block by ImageCerberusPLG4.

It was a .gif that was only a small white rectangle.

Added the exception to local.cf and all is good.

Thanks!


-