How will you know WSA is "rolling back"?

I believe the "roll back" removal process is tied to both the default heuristics, and the option in settings, "Advanced journalling of monitored files" or something like that.

But how will the end user know it is rolling back? Will it say something different during the cleanup wizard thing (the thing that tells you steps before proceeding)?

I'm just curious.

EDIT: Also, if you manually place a file in monitor mode then decide to block it or do a manual malware removal, does the roll back effect happen still even tho you manually flagged it?

 

It happens automatically and silently. You won't see what it's doing besides that it's removing the infections, but yes, if you manually add a file to cleanup, it will be rolled back as well.

 

Awesome.

I assume rollback only is possible for monitored programs?

 

Yes, which, by definition, will include any possibly missed malware as any program which isn't trusted (whitelisted) will be set to Monitor.