hello, In rules/README, I see that the direction could be Virus: Is Virus: acting also for Filename ? I think it should be interesting to have different directions for these cases as the viruses could be easily dropped but the attachments which are put in quarantine because of their names should be kept. -- Pascal