Ok, the name of the file with the virus warning is:
c:\windows\msmgt.exe
I never use WinME (Microsoft's worst joke ever), but I didn't know WinME had the system restore, I thought that was XP. But it makes sense. Unfortunately that folder is filling up with the user, not knowingly, setting restore points.
I will get her to do an online scan while avast is paused.
Thanks for the ideas and help,
B.