Filter out .gif Spam

[ric07]

I get hundreds of spams that consist of random words and a .gif file which is the real message about a penny stock. I have not been able to figure out how to filter it as the attachment does not appear in the HTML version of the message.

Ric

[Peva]

Try this: Customize the filter conditions to add the "Content-Type" header (in Filter Rules window, click "Customize..." in the drop down and add the header name), and have the condition value be "multipart" (header name may vary with server software - qmail software header is "Content-Type")?

[Old Egidio]

I posted a note here and in other TBird forums about a filter to get rid of that type of spam. Expanding on what Peva said, create a filter for “content-type” as multipart/related.

Match all of the following conditions:
Content-Type contains multipart/related
From isn't in my address book (repeat this for each address book)

Action:
Send the message to the Junk folder.
Set its status to junk.

All those spam messages with gif attachments have been correctly identified so far. The inclusion of the address book condition helps since your friends might end up sending you a gif that is not spam. If that happens, the filter will not move the message since all conditions were not met.

I've been using this filter for about a week now, and it has so far worked 100% accurately.

[ric07]

Seems to work great! Thanks so much!

Ric

[Old Egidio]

You're welcome. Just keep an eye out at your junk folder before you trash those messages. So far I have not had any good messages incorrectly labeled.

[Kab]

I use this exact filter set up for the exact spam and more and it did wrongly remove one of my emails. One for thousands successfully removed, however, because the emails had not been compacted I closed/restarted Thunderbird and it came back up again
By my recollection its nearly 3 weeks since I've been using it.

Be careful and have your mail settings to send to Junk rather than delete... as I do.