Masken,

I've been on the GFI board asking questions about OCR. Looks like that's not going to be a very good option for ME for the time being. I was able to dramatically change the amount of image spam that enters my network though. Here's what I did:

Upgraded to ME12
Enabled Directory Harvesting
Enabled more DNS blacklists (i.e. relays.orbd.org, list.dsbl.org, dnsbl.njabl.org, sbl-xbl.spamhaus.org, blsmapcop.net)
Performed a regedit, increase image/text count GFI Regedit Link
Reorder my rules to following:
Custom Blacklist
Email / Domain Whitelist
IP Whitelist
Keyword Whitelist
DNS Blacklist
Spam URI Realtime Blocklist
Keywork Checking
Directory Harvesting
Header Checking
Bayesian Analysis
Sender Policy Framework
Phishing URL Blacklist

And then finally I edited my whitelist and took out some *@cisco.com references (where an entire domain name would be whitelisted.)

I used to have approx 3000+ emails in my quarantine mailbox per day but now I only have about 500.

My organization receives 17000+ emails a day, 95% is spam.
_________________________
let the wise listen and add to their learning,
and let the discerning get guidance- Proverbs 1:5