For bonus points, make the software realize that even if the file on the CD looks infected, it isn't actually infected, so make that file's SHA-256 sum a 'known good' profile. (If the file on the actual install CD really is infected, that falls into the category of "Problems The AV Can't Solve". At that point, the OS itself is controlled by Malign Forces Working To Destroy You and the game is over.)
For extra special bonus points, code compressed copies of those essential files into the AV software itself, so they can be replaced on the fly without prompting anyone. They can be updated along with the malware profile data, if they ever need to be.
2. You can't put compressed copies of essential files into the AV software itself for a couple for a couple of reasons:
- Microsoft will sue you for distributing their intellectual property without permission (and is not likely to grant such permission, since they can't control the quality of the third-party software).
- These files are not static: they could have been modified by any Windows update, and might be dependent on other updated files.
Keeping track of the hashes of "known good" files might work, but you'd have to account for files that were modified by Microsoft patches.