2

It is not unusual that after VPS updates that you may find it detects something previously undetected.

However, looking at the FileID: number it looks like it first found the one, restart.exe in the system32 folder and the act of moving it meant system restore saved a copy of it in the C:\System Volume Information folder. I say this as the detection is the same spyware-gen.

Restart.exe could well be a tool (given its location in a Tools, sub-folder of system32) but tools can be used for good or evil as avast can’t determine use. I don’t have a Tools sub-folder of system32 so you have to ask what put it there.

You could also check the offending/suspect file at: VirusTotal - Multi engine on-line virus scanner and report the findings here. I feel virustotal is the better option as it uses the windows version of avast (more packers supported) and there are currently over 30 different scanners.

If it is indeed a false positive, add it to the exclusions lists:
Standard Shield, Customize, Advanced, Add and
Program Settings, Exclusions
Restore it to its original location, periodically check it (scan it in the chest), there should still be a copy in the chest even though you restored it to the original location. When it is no longer detected then you can also remove it from the Standard Shield and Program Settings, exclusions.

Send the sample to virus@avast.com zipped and password protected with the password in email body and false positive in the subject.

Or if it is in the avast chest send it from there (select the file, right click, email to Alwil Software). No need to zip and PW protect when the sample is sent from chest. A copy of the file/s will remain in the original location, so any further action you take can remove that.