cheers i managed to get it sorted they was setting UviProcessExcludes via GPP registry but normally after adding a process to UviProcessExcluded it requires a reboot. As they was using PVS i booted the Vdisk into MM and baked it into the image and rebooted and sealed and promoted. Now i dont see the Mfaphook64.dll in use when using Excel.exe