what do you want to roll back?
2 scenerios:
If virus: nothing it does affects the real system. Because CIS has CPU Enforced OS Virtualization, everything the virus does stays in containment (Virtualization) and by simply resetting containment all the stuff virus does goes away.
if Legit file: once you have whitelisted it, and run it again, it will go ahead and establish everything outside containment.
Among other things the description of Virusscope tells you this: "And keeps a record of their activities"
Why would you keep a record if not for some kind of rollback?
Legit files and whitelisting is not ment for the broad masses of users, they have no idea what they are whitelisting.
Look at Webroot or Kaspersky, the also keeps a record of the unknown files activities, and when deemed bad the get rolled back, or if the files is good it get released from monitored state into the system.
This approach, (not perfect I know) but it keeps the user from making the wrong decision, that is your job as a antivirus vendor.
Just my point of view of course.
/W
