I was looking in the filenames file at the CLSID line. Doesn't this match any file name containing that 25 character string in {}, not just ending in that string? hermit921 # Deny filenames ending with CLSID's deny \{[a-hA-H0-9-]{25,}\} Filename trying to hide its real type Files containing CLSID's are trying to hide their real type