1. At least one non-transitory machine accessible storage medium having instructions stored thereon, the instructions when executed on a computer, cause the computer to: scan to determine that a file in at least a portion of a computer memory is a malicious file; make a copy of the file that can be restored; delete the file from the portion of memory; responsive to an indication that the determination of the file as malicious is a false positive, prompt the user to initiate a reboot; and in response to the reboot initiation, cause the file to be restored to the computer using the copy.