1. A computer-implemented method, comprising: executing at least one system restore in a computing device, the system restore restoring a first set of resources stored in the computing device; analyzing a plurality of conditions to determine if malware detection is needed during system restoration, the plurality of conditions including restoration history, system settings and infection history; in response to determining that malware detection is needed, selecting a level of scanning from at least one of a deep scan level or a user scan level, wherein the deep scan level is selected when at least one of the plurality of conditions exceeds a threshold, wherein the user scan level is selected when none of the plurality of conditions exceeds a threshold; and scanning, during the system restoration, a second set of resources that were not restored, at the selected level of scanning.