Why don't more organizations use a lock-down tool such as DeepFreeze (http://www.faronics.com/)? With DeepFreeze on a machine, you simply reboot and the malware is gone. There is the capability in DeepFreeze to allow "thawed space" so if you need to keep anything around between reboots you can put it there (or use a network drive). Windows allows you to remap directories, so "My Documents" and other necessary folders can be mapped to the thaw space. When you are dealing with large institutions (education, government, etc...), the time saved cleaning or rebuilding machines will more than offset the licensing costs. You can even automate the process to have a machine thaw itself, install updates, and refreeze itself overnight. Machines can also be rebooted (or thawed) remotely. It's a very useful program to have.