Ages ago, I suggested that :- On Tue, 25 Nov 2003 18:00:15 +0000, Mike Meredith wrote: > use Postfix body checks to look for > /^TVqQAAM/ which should match every Windows executable in base64. I could be used to block Windows executables. It seems that :- /^TV[nopqr][A-Z]...[AB]..A.A/ is a better regexp that's floating around.