When you turn off System Restore, it deletes all the files it contains. That's why it takes a while to actually switch off, depending how much space you have given it.
Who knows how these things get in? Some of them are very crafty, and can act like a time bomb. They appear quite innocuous to security software, until a pre-set time / date occurs, then the trojan becomes active, and the security should then spot it, which it seems it did, so you should now be OK.
