David H. Lipman wrote:
> From: "Buffalo" <Eric@nada.com.invalid>
>
>> Winnit\System32\sysrestore was submitted just now.
>> It is back in quarantine in MBAM now.
>
>
> False Positive. It is being removed from MBAM definitions.

Thank you for the follow through.
Buffalo