blocking HTML image based spam by regular expression - ORF Forums

I'm trying to block spams with images which have the same pattern in its HTML source code. the spam comes from different IP and domain name, but seems come from the same marketing company. The email has the same image logo most of time, and the image name is 'logo2.jpg'.
I tried to block it by entering it to keyword blacklist checking with regular expression by selecting 'Email Body' then 'Body raw HTML source', then reg. exp. as following;

.*logo2.jpg.*

But it doesn't filter at all. What am I doing wrong?

solved. I didn't save the configuration after I made the exp.