We had a user (with Box Drive) who had a file marked as malicious. She apparently made a change to a local copy and added it back to her folder, causing it to be marked as malicious a second time. In fairness, the hash is different, since the file changed. When I looked at the first event, I ran the file through VT, and the results came back as all clean, so I marked it as not malicious. The user was still not able to access the file. I had to go back into Shield, find the second instance, scan it with VT, and mark it as not malicious there also. The user was then able to access the file. I'm concerned that each time she makes a change to the file, it will be flagged as malicious again by Shield. It would be helpful if there was a way to mark the file as not malicious in a way that would persist.