Shouldn't a system restore be ok to restore it pre-virus?
No, as viruses can hide in restore points to avoid scans
Is it a sign that it is infected that it wont go online to update SAS?
Surely the fact that SAS says the last scan was 17/3/2011 MEANS that that was when the last scan was run??
Yes But if its been restored to a previous date then when was that date? A week after the 17/3?