Malware removal process suggestions/tips

I work in the tech support department of my university fixing student's computers, which is 90% of the time laptops and 70% of the time viruses. Since it is so often viruses, we have developed a process to make things easier. I'm going to post it here so I can get some suggestions on what we could rearrange, add, or remove in order to make things better, easier, quicker, etc. We do a lot of virus removal so we leave the longest scans for last so they are able to run overnight, sometimes we have 7 or 8 laptops at a time all running Malwarebytes or SpyBot overnight. Anyways, here is the process:

1. Load a clean, formatted USB key with the needed programs, all portable versions, and plug the loaded USB key into the infected computer.
2. Run Rkill.
3. Run Revo Uninstaller to remove any obvious Malware/Adware/Spyware from the programs list, using the "deep clean" option to scan for any registry or other remnants.
4. Run TDSS Killer with all options enabled, which will then reboot the system after scanning unless no infections are found. Run Rkill again after system reboots if it reboots.
5. Run NPE (Norton Power Eraser), which will reboot the system and scan. After scanning, run Rkill.
6. Run RougeKiller.
7. Run JRE (Junkware Removal Tool).
8. Run ADW Cleaner. After it runs, it will restart the computer. After the computer restarts, run Rkill again.
9. Run Malwarebytes portable.
10. Run Spybot Portable.
11. Run CCleaner.
12. Run whatever anti-virus the user has installed, and if none is available install and run Microsoft Security Essentials.
13. Remove any remnants such as logs or temporary files the scans left behind and it is finished! The computer should be clean and good to go.

If the built-in antivirus detects a strangely large amount of viruses (it shouldn't by that point), run through the process again until no detections are made. We figured that if this process can't remove all the viruses it will just be faster, in most cases, to back up the user data and reinstall the operating system as this list includes some pretty heavy-duty programs.

 

Thank you for your suggestions! I'm going to suggest to my boss (who has stated multiple times that he is VERY open to changes) immediately replacing Spybot with SUPERAntiSpyware, as it does look a lot better, and also removing NPE from the list of tools, as well as only running Rkill once (unless of course it finds something).

I will address some of the rest of your comments now, but I will also take time to have a deeper look at the process while taking your suggestions strongly into account to develop a better and more-personalized process, as you are right when you say that we should take advantage of having actual hands-on with the user's hardware.

As for Windows XP, it isn't supported by our University, so if the user has it they won't even be able to access the Internet on the University's network. I've worked there for a little over three months now and I have yet to see any laptops come in with XP installed on them.

Also, when we reinstall Windows, we explain to the user that all we will do is make a list of their currently installed applications, back up their "User" folder (and then we also explain the contents of the User folder), reinstall Windows based from the built-in reinstall partition (if there is one, if not we have media available), and restore their User folder to their desktop. Most users are perfectly fine with this procedure and customizing Windows back to the way they like, and if they want us to do more customization we are able and willing to accommodate any specific instructions. I realize that if the infection has spread to or targets specifically the reinstall partition, the new install of Windows will be infected as well. Right now we have Malwarebytes set to scan all partitions although you are correct about the possibility of a recovery partition virus and I will have to look into better ways of doing this procedure if we do end up reinstalling Windows from a recovery partition.

We are a free service to the student population and employ several students who have no previous experience with malware removal (the only real requirement to the job is being in the STEM degree program), so we do want the process to be as easy as possible for the student employees. I feel the best solution is to take small steps at a time, and hopefully by less than a year we have a better, more in-depth (and more hands on) process that everyone feels comfortable with.