Before restoring the system, make sure you delete those notes, then you can enable Auditing to track file changes on the folder(s) where you see those files recreated (open folder Properties->Security->Advanced->Auditing). All changes will be reported in the Security log. They will provide you with more information about the process which creates those files.
There are chances you might find the malicious process right in the log information. There is also the possibility to find an intermediary process instead (e.g. a cmd.exe which executes a script that copies files). In this case it would be best also to enable Process Tracking Auditing (this is done from Local/Group Security Policy) before those files are recreated (e.g. after system restore, boot into safe mode and enable the auditing), however this is not guaranteed to work in all cases, as it depends on how the malware gets executed when the system starts.
Last, but not least, you might need to consider the scenario in which the system snapshot you try to restore might be already infected.