1. A method for restoring a computer system modified by malicious code, comprising: scanning the computer system for the malicious code; identifying the malicious code; retrieving from a data file, information relating to the malicious code including at least one command used for restoring the computer system to a state that existed prior to modification by the malicious code; and executing the at least one command to restore the computer system to substantially the state as it existed prior to modification by the malicious code.