Filters for .gif spam?

[Mike]

Darrin Chandler wrote:
> On Tue, Nov 21, 2006 at 10:15:18PM -0700, Kurt Granroth wrote:
>   
>> How are y'all dealing with the massive increase in .gif spam?  Those are
>> the emails that have some random innocuous text and then an attached gif
>> file that contains the actual spam message (usually stock pump-n-dumps).
>>  My spamassassin and bogofilter setup is just not catching those at all.
>>
>> What I'd like to do is create some sort of filter that will capture
>> *all* messages that have a single .gif attachment and put them into a
>> "probably spam" folder.  Unfortunately, I cannot yet figure out how to
>> do this.
>>
>> It looks like SA might not inspect attachments at all so I moved on to
>> procmail.  Procmail, too, seems to have little to no knowledge of
>> attachments.  Maybe Amavis?  Seems weird to use an anti-virus app for
>> spam, though.
>>
>> So what are y'all doing to combat these?
>>     
>
> I've seen a couple of those come through lately, but not too many. Are
> you greylisting?
>
>   
I get gazillions of them every day but I rarely ever see one. I've had 
really good luck with bayes catching literally any amount of garbage 
text they throw at me. Are you sa-learn'ing your spam and ham? I have a 
cron job setup to do this every sunday night.

-Mike