Yes, all nlite mode of sfc_os.dll from original XP are marked like win32\patched.NAW Trojan Even add this to excludes, NOD still alerts! And some...
Separate names with a comma.