Right, you have a slightly different problem because your live version of netapi32 is flagged as a trojan and not just backups. I would have guessed that the file is in SP3 and you haven't installed SP4 then but you are running SP4 so I dunno. I'd leave it excluded from AMON. if It is still there, just marked for delete, make a copy of it now and put that in the same dir with a slightly different name. On next boot, rename it to the original if the other one is gone and reboot again. I don't know how to unflag a file for delete. Anyone?