A virus can't do anything that you can't do.

Note that if you're running as a local administrator (or otherwise have the backup files and folders right), you can override ACLs at will. Also, if you're listed as the owner of an object, you can change the ACL at any time.

Ditto if the hostile code gets on your system by exploiting a service or something that's running as LocalSystem -- SYSTEM is a rather powerful entity.

But if you're running as a regular user, any virus you run is limited to messing with things you have permission to or are listed as the owner of.