Hi Peter... Try this SA-Rule: rawbody BagleQ_Found /(?:\<object\s{1,3}style\=\Sdisplay\:none.{1,5} data\=.http\:\/\/([1-9]+[\.|\:|\/])+\w+\.php)/i describe BagleQ_Found Worm Bagle-Q found score BagleQ_Found 10.0 Holger