I believe the "roll back" removal process is tied to both the default heuristics, and the option in settings, "Advanced journalling of monitored files" or something like that. But how will the end user know it is rolling back? Will it say something different during the cleanup wizard thing (the thing that tells you steps before proceeding)? I'm just curious. EDIT: Also, if you manually place a file in monitor mode then decide to block it or do a manual malware removal, does the roll back effect happen still even tho you manually flagged it?