This doesn't make any sense to me. It doesn't matter whether you start
System Restore by hitting the Windows Key + R to get Run and then typing
the path to rstrui.exe or whether you start System Restore by mousing to
Start>Programs>Accessories>System Tools>System Restore. The same rstrui.exe
is called and rstrui.exe is disabled by the malware. The best solution is
not to get infected to begin with.