Malware can disable System Restore and delete existing restore points if the user account they are running under has the rights to do so. I think the Cryptolocker variants did this, but not sure...