David H. Lipman wrote:
> From: "Buffalo" <Eric@nada.com.invalid>
>
>
>
>> I will delete that setup file and I will keep the
>> winnit\system32\sysrestore.dll in MBAM's quarantine in case I wish
>> to analayze it further.
>
>
> Please upload the file here...
> http://www.uploadmalware.com

Winnit\System32\sysrestore was submitted just now.
It is back in quarantine in MBAM now.