I have never had a virus move from a connected drive to the computer. The file is being accessed/scanned by the AV program. Not being executed. I have done this dozens of times for AV fixes, and for data recovery.
Also the pagefile, and the hibernate file, are deleted much easier. Viri put themselves in the files when the computer is powered-off. This means, one of the first steps is to disable the page and the hibernate functions.
DO NOT use more than one AV program at once. I have "fixed" 6 computers in 6 months because Adobe "included" norton, and mcafee, when installing flash, shockwave, reader. And users do not read, and uncheck the "FREE" crap.
W7 includes an imager, w8 does not.
I do not agree to disable system restore for the OS drive. However, when the compute is running fine, I create a new restore point and then use DiskClean to delete all but the most recent restore points.
And then I image.
Need to use a 2nd disk, internal, or external.
I have macrium on the audio computer.
And have just installed Paragon free on a w8 machine for testing.
(
http://www.paragon-software.com/home/br-free/)
And: I suggest using SuperAntispyware, and spybot, and kaspersky, and other, scanners to get any stuff AVG and MS have not caught.
I have Spybot teatimer starting on all computers to monitor changes to the startup areas of the registry.
And: update Malwarebytes again, and run full scan, again. Sometimes the virus is new, and all the AV program updates may not be as timely as we want.
And: change your email passwords to something NOT easy. 3 people I know were recently stranded in Spain because their passwords were way easy.