-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Evan Platt wrote:
> Lately, I'm seeing JPG attachments that are 'crooked' (see
> http://www.espphotography.com/crookedjpg.jpg ) . These aren't hitting
> any points with FuzzyOCR.
>
> Am I missing something? Do these hit for anyone else?
Hmm, I just setup FuzzyOCR on a new SA server yesterday and, while it
seems to be working, mine didn't catch this either.
I attached your image to an email I sent myself and got the following
results:
X-Spam-Report:
* -1.4 ALL_TRUSTED Passed through trusted hosts only via SMTP
* 0.6 AWL AWL: From: address is in the auto white-list
- From my FuzzyOCR.log file:
2007-02-25 19:04:47 [15469] Starting FuzzyOcr...
2007-02-25 19:04:47 [15469] Processing Message with ID
"<[EMAIL PROTECTED]>" (David Goldsmith <[EMAIL PROTECTED]> ->
David Goldsmith <[EMAIL PROTECTED]>)
2007-02-25 19:04:47 [15469] fname: "crookedjpg.jpg" => "crookedjpg.jpg"
2007-02-25 19:04:47 [15469] JPEG: [360x491] crookedjpg.jpg (55507)
2007-02-25 19:04:47 [15469] Saved:
/tmp/.spamassassin15469Cr5QSWtmp/crookedjpg.jpg
2007-02-25 19:04:47 [15469] Saved: /tmp/.spamassassin15469Cr5QSWtmp/raw.eml
2007-02-25 19:04:47 [15469] Found: 1 images
2007-02-25 19:04:47 [15469] pfile =>
/tmp/.spamassassin15469Cr5QSWtmp/crookedjpg.jpg.pnm
2007-02-25 19:04:47 [15469] efile =>
/tmp/.spamassassin15469Cr5QSWtmp/crookedjpg.jpg.err
2007-02-25 19:04:47 [15469] File has Content-Type "image/jpeg" and File
Extension "jpg"
2007-02-25 19:04:47 [15469] Found JPEG header name="crookedjpg.jpg"
2007-02-25 19:04:47 [16061] Exec : /usr/bin/jpegtopnm
/tmp/.spamassassin15469Cr5QSWtmp/crookedjpg.jpg
2007-02-25 19:04:47 [16061] Stdout:
>/tmp/.spamassassin15469Cr5QSWtmp/crookedjpg.jpg.pnm
2007-02-25 19:04:47 [16061] Stderr:
>>/tmp/.spamassassin15469Cr5QSWtmp/crookedjpg.jpg.err
2007-02-25 19:04:47 [15469] Saved pid: 16061
2007-02-25 19:04:47 [15469] Elapsed [16061]: 0.031555 sec.
(/usr/bin/jpegtopnm: exit 0)
2007-02-25 19:04:47 [15469] Calculating image hash for:
/tmp/.spamassassin15469Cr5QSWtmp/crookedjpg.jpg.pnm
2007-02-25 19:04:48 [15469] Saved pid: 16062
2007-02-25 19:04:48 [16062] Exec : /usr/bin/ppmhist -noheader
/tmp/.spamassassin15469Cr5QSWtmp/crookedjpg.jpg.pnm
2007-02-25 19:04:48 [16062] Stdout:
>/tmp/.spamassassin15469Cr5QSWtmp/ppmhist.info
2007-02-25 19:04:48 [16062] Stderr: >/dev/null
2007-02-25 19:04:48 [15469] Elapsed [16062]: 0.052911 sec.
(/usr/bin/ppmhist: exit 0)
2007-02-25 19:04:48 [15469] Got:
<530295:360:491:14321::255:251:255:253:7774::255:255:228:252:7550::255:255:226:252:6649::255:252:249:253:6392::255:252:251:253:6053::255:255:230:252:5502>
2007-02-25 19:08:44 [15470] Scan canceled, message has already more than
10 points (15.148).
2007-02-25 19:08:44 [15470] Processed in 0.000229 sec.
2007-02-25 19:09:00 [15469] Scan canceled, message has already more than
10 points (31.104).
2007-02-25 19:09:00 [15469] Processed in 0.000227 sec.
2007-02-25 19:11:06 [15469] Scan canceled, message has already more than
10 points (19.551).
Not sure what the reference to 10 points is, must be FuzzyOCR related
since SA gave the message a negative score.
David Goldsmith
- --
"My company will receive a ten fold return from the investment in SANS
Security training."
Cary Polk, Humanna Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.3rc2 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
iD8DBQFF4eJH417vU8/9QfkRAuQ4AJ9XJ4+RO6XE+TOJ65bhJREQJiu4bACeM1CC
uHOFkq6iV9z1dVH9VsBuvxA=
=9VDf
-----END PGP SIGNATURE-----
