For what it's worth, SARE has their own download script (I'm not familiar with the sa-update script Bill mentioned) called RulesDuJour which is a bash shell script:
http://www.exit0.us/index.php?pagename=RulesDuJour And that page contains a howto link for us Windows users who are running CygWin: http://www.exit0.us/index.php?pagename=InstallRdjOnCygwin Andrew 8) > -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of Nick Hayer > Sent: Thursday, May 04, 2006 1:50 PM > To: Declude.JunkMail@declude.com > Subject: Re: [Declude.JunkMail] image spam > > Thanks Bill. I have been using the SARE stock rules but the > others I was unaware of - as well as the update script! > > -Nick > > > Bill Landry wrote: > > > You might also want to look at using the SARE rules at > > http://www.rulesemporium.com/rules.htm, particularly the SARE Stock > > rules (70_sare_stocks.cf). Also, a couple of Fred's rule sets at > > http://www.rulesemporium.com/other-rules.htm (88_FVGT_rawbody.cf & > > 99_FVGT_meta.cf) can be quite helpful, as well. > > > > If you are running SA 3.1.1, you can also use the sa-update > script to > > pull down the latest SA rules, which includes additional > rules found > > in the 80_additional.cf rule set that are very good at > tagging these > > kinds of image spams. > > > > And finally, Sniffer seems to successfully tag almost 100% of these > > image spams, and Razor tags a majority of them, as well. > > > > Bill > > ----- Original Message ----- From: "Nick Hayer" > > <[EMAIL PROTECTED]> > > To: <Declude.JunkMail@declude.com> > > Sent: Thursday, May 04, 2006 7:39 AM > > Subject: [Declude.JunkMail] image spam > > > > > >> fyi - > >> > >> I just found these 2 plugins for spamassassin > >> http://wiki.apache.org/spamassassin/OcrPlugin > >> http://antispam.imp.ch/patches/patch-ocrtext > >> > >> That will ocr the gifs, etc. These should help SA be even more > >> effective within Declude.. > >> > >> -Nick > >> --- > >> This E-mail came from the Declude.JunkMail mailing list. To > >> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type > >> "unsubscribe Declude.JunkMail". The archives can be found at > >> http://www.mail-archive.com. > >> > > > > --- > > This E-mail came from the Declude.JunkMail mailing list. To > > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type > > "unsubscribe Declude.JunkMail". The archives can be found at > > http://www.mail-archive.com. > > > > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be > found at http://www.mail-archive.com. > --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
