A lot of threats can even use the system restore points to reinfect the system after it has been removed. That's why its always good to disable system restore when removing threats and only re-enabling it once all threats are gone.