i got EXCEL.exe added to UviProcessExcludes in HKLM\system\Currentcontrolset\Services\CtxUVI but when i fire up sysinternals process explorer and check EXCEL.exe for a user and the DLL view i see the mfaphook64.dll loaded ? i thought the reg key was meant to disable the API hooks for the process ?