On Mon, 31 Mar 2003, -ray wrote: > if (join("",@{$entity->body}) =~ /TVqQAAMAAAAEAAAA/) { I suspect that will match most M$ Windoze executables encoded using base64 encoding. Regards, David.