Patent ID: 8539583

Claim:
A computer-implemented method, comprising: determining, by a malware protection program executing on a computer, that a file stored in first portion of a computer memory of the computer is a malicious file; storing a duplicate of the file in a quarantine area in the computer memory, the quarantine area being in a second portion of the computer memory that is different from the first portion of the computer memory; performing, by the malware protection program, one or more protection processes on the file; determining whether the determination that the file is a malicious file is a false positive determination; in response to determining that the determination that the file is a malicious file is a false positive determination: restoring the file by a pre-boot rollback process executing on the computer during a boot sequence to a state prior to the one or more protection processes performed on the file; and booting the computer with the restored file; and in response to determining that the determination that the file is a malicious file is not a false positive determination, not restoring the file to a state prior to the one or more protection processes performed on the file.