Philip... you can try this one... your postfix version is high enough, then it must come from your regexp. I used to remember that the regexps below used to be shown on the postfix ml.... you just have to sort what's important for you and what is not... I don't want to prove this or that regarding one single regexp or multiple regexps and whether it's more powerfull or quicker.... do as you feel, and if you really experience performance issues, then try to put your regexp into one single line. /name=\"(.*)\.(shm|hta|pif|com|vbs|vbe|js|jse|bat|cmd|vxd|scr|exe)\"$/ REJECT /(filename|name)=".*\.(asd|chm|dll|hlp|hta|js|ocx|pif)"/ REJECT /(filename|name)=".*\.(scr|shb|shs|vb|vbe|vbs|wsf|wsh)"/ REJECT /(filename|name)="(Happy99|Navidad|prettypark)\.exe"/ REJECT /(filename|name)="(pretty park|zipped_files|flcss)\.exe"/ REJECT /(filename|name)="(Msinit|wininit|msi216)\.exe"/ REJECT /(filename|name)="(Avp_updates|Qi_test|Anti_cih)\.exe"/ REJECT /(filename|name)="(Emanuel|kmbfejkm|NakedWife)\.exe"/ REJECT /(filename|name)="(Seicho_no_ie|JAMGCJJA|Sulfnbk)\.exe"/ REJECT I hope this will help. I have tried them some time ago, and they were ok... Stephane