I welcome any additions or corrections to this.It is based on what I have observed is done-or not done-by those who assist in the malware cleaning.

1. Always open the first Hijackthis log and check for inappropriate entries.
2. Have these entries removed at the beginning of the cleaning. Even though some may recur, those that do not will assist in the cleaning.
3. Check for the presence-or absence of security programs. Cleaning a system that has no antivirus program running is a waste of time.
4. Make sure there is only ONE antivirus program. I recently saw a log pronounced 'clean' but the user had three security suites running! Conflicts cause by this can leave the user unprotected.
5. Check for the Java and Adobe updates. Although this is mentioned in the cleaning, it is often skipped and these updates are almost always for security vulnerabilities. Earlier versions must be removed.
6. If I notice an overabundance to startups in the log, I mention it to the user. Although this is not related to malware, it is related to the overall health of the system.The users who choose to stop the unnecessary startups always experience a shorter startup and shutdown time as well as faster surfing.
7. If you are unsure of any entry, ASK the user about it. Have them verify that they installed or set it up, Malware will sometimes affect the 'Restrictions' settings.
8. Alert the user NOT to use System Restore. Logs will show malware in the 'system volume' but users don't realize this means restore points. :P

__________________
wave:Computer Support and Help
Virus & Malware Removal
Tutorials on "How To...."
Stop Nuisance Startups