In writing the script to check for the Nimda virus I came across a startling fact. It was running very slowly because I was using regular expressions. I switched from ereg to preg_match and it was a lot faster. But even faster that was strpos. Which was still slower than a Perl regexp. PHP and regexps are pretty slow.