1. At least one machine accessible storage medium having instructions stored thereon, the instructions when executed on a machine, cause the machine to: determine that a file stored in a first portion of a computer memory of a computer is a malicious file; store a duplicate of the file in a quarantine area in the computer memory, the quarantine area being in a second portion of the computer memory that is different from the first portion of the computer memory; perform one or more protection processes on the file; determine that the determination that the file is a malicious file is a false positive; and restore the file, during a boot sequence, to a state prior to the one or more protection processes being performed on the file, wherein the computer is to be booted with the restored file.